Did you actually find the breach? Did you grep -ri "base64_decode" . ? Check to see if it was done via SQL injection by grep -i the logs for "OUTFILE" / "DUMPFILE", alternatively "EXEC", alternatively http://code.google.com/p/apache-scalp/ , alternatively take the professional route and install an intrusion detection system

It was way less exciting than that.
FTP password was compromised. All relevant passwords were changed and computers are being scanned for malware.

I did check the rest of the site for base64'd content, iframes, and external scripts. Everything seems to be clean.

I guess I *could* install an IPS, but that's up to the serverguys.

yet again, scannie saves the day! thanks dude

Scancode is indeed worthy of a imaginary statue for his heroic deeds.

Also I guess the extreme slowness of the forums are gone now?

It's been gone for awhile. At least for me.

I meant like, FOREVER! But yeah, I havent notised it either but it used to come and go.