Upgrading hacked site to Evo 1.0.6

I just got an email from a client who I built an EVO 1.0.5 site for. It has been hacked and their host said:

we found 464 hacked files that we were able to try and clean.

Likely hacked code / hacker shells that we could not automatically clean were found here:
/assets/snippets/ajaxSearch/js/mootools2/mootools-1.2.4-core.js.txt
/backup/archive/_notes/lutherchang.php
/backup/archive/bambyalma.php

I have never seen the last two files so will be deleting them promptly.

I want to upgrade the site to 1.0.6 but an concerned about hacked files lingering around. Should I start with a clean install and not overwrite 1.0.5 with 1.0.6. Is it possible the hacker could have done something to the database and is there an easy way I can detect that?

Many Thanks [ed. note: zerograv last edited this post 14 years, 7 months ago.]

Highly unlikely the hacker got into your database. You can do a clean install of 1.0.6, then manually replace the database with your old database, then run the 1.0.6 installer in upgrade mode. You'll need to manually add your images and templates, as well as any custom snippets or plugins in the file system.