s2member interface gone - possibly hacked

I watched the video on why the backend interface of s2member may dissapear.
I believe the site was hacked but can't find the source yet.
I use firefox error console to see if I can find a reason why the s2member pages are blank, and all I get it this:
(I changed the links above). And the links and test randomize on each visit.
Can you help me find WHERE the corrupt file or code is? thanks
I believe the site was hacked but can't find the source yet.
I use firefox error console to see if I can find a reason why the s2member pages are blank, and all I get it this:
- Code: Select all
Error: missing } in XML expression
Source File: http://mysite.com/?ws_plugin__s2member_menu_pages_js=269846997&ver=110815-196298582
Line: 1, Column: 22
Source Code:
<style>#dspg {position:absolute;overflow:auto;height:0;width:0;}</style><font id="dspg"><br><a href="http://blog.xxxxxxxx.com/?eed=xxxxx.php">cartel movie soundtrack</a></br>
(I changed the links above). And the links and test randomize on each visit.
Can you help me find WHERE the corrupt file or code is? thanks