Okay so my forum was hacked sometime last week and I've been trying to fix it. It was a weird malicious javascript thing that injected itself all over - like in javascript files - and there was a hugeee php eval with a bunch of hex at the top of some php files. The boards were maybe one or two releases behind so maybe that's why. Anyway, I removed ALL the files from the server, and uploaded a fresh copy.
What I'm worried about is that I don't know if anything is in the database at all and I'm curious how I can check. Are there common tables that hacks occur in? I can restore a backup (three are made a day) but it happened last week and I only noticed it once google blacklisted the domain.