I've cleaned up a bunch of compromised servers, and I've never encountered—at least with exploited wordpress installs—an attacker sophisticated enough to change

I've cleaned up a bunch of compromised servers, and I've never encountered—at least with exploited wordpress installs—an attacker sophisticated enough to change the timestamps on the files containing back doors, so, while I always just overwrote everything from a backup, finding all of the backdoored files right away would amount to something like: $ find /var/www/blah.com/htdocs/ -iname "*.php" -mtime -1 -print