Are you still in a position to do 'diff -r' on the dirs? I'd like to see the difference.
sorry i'm not. because the hacked server was already removed.
By the way from what I have seen, there was some file missing: hostedlogin.jsp, authorize.jsp and access.jsp for sure.