Blog Hacked: c99shell 2.0 madnet edition

Our blog got hacked and I have no idea how to remedy this, short of wiping the whole folder clean.

If you go to https://www.pivotalsolutions.com/hrblog you will be prompted to enter user information to enter admin area. “The server says: c99shell 2.0 madnet edition: admin area”

I’ve changed the database login information and config file. Where should I look for compromised files or lines of code?