Need help dealing with a hack
 

http://atbnet.us/images/attack.png

Yesterday I got hacked somehow, I am not completely sure how. I reviewed the admin logs and somehow this person just started inserting files into my database and then got access. They then uploaded this tool to cause some havoc. I already removed the defacing pages from the site, but this tool remains. It shows up when you use the subscription manager under paid subscriptions. I have used the tool to verify that the remaining files are legit and have even replaced the subscriptions.php file under the admincp, but this still remains, so it must be in my database somewhere.

The forum is completely locked down now which I should have done in the first place but I guess I didn't think it would happen to me. Any help would be greatly appreciated.