Unfortunately some files do have to be set to 666/777 for scripts to save configuration data, such as a lot of forums, so it's not possible to lock down everything worse luck.
If you've got the date/time of the attack, you should be able to find the affected files by checking their date stamp.
|