If you suspect you have been hacked this script can give you a bit of information on where to look if it is related to php

Just plase it in your directory and the script will search from "." The script give quite a lot false positives, but it should be easy to spot files that are not false positives.