Here's a few commands you'll want to run from shell to look for any more exploited code
grep -R eval * | grep POST
grep -R eval * | grep REQUEST
Found a few of these in various files on a couple servers that allowed for the hacker to pretty much do whatever they want.