Cleaning Up Your Hacked WordPress Site
1) Back up all wanted files
I back up my theme, export my posts, pages and comments via the built-in Export tool. Remember, the import/export tool only works for up to 7MBs, so you may want to consider exporting your database tables separately too. I back up my full database, too using phpmyadmin (even though I know it is quite possibly the culprit)
2) Make note of all plugins you need/want to reinstall and your sidebar widget configuration (if any).
This is a good opportunity to purge your site of unused or unnecessary plugins.
3) Create your new database via phpmyadmin.
4) Create new sub-directory.
I install my new version on a sub-directory and move it over via the instructions here: http://codex.wordpress.org/Giving_WordPress_Its_Own_Directory
5) Upload most current version of WordPress and go through install (updating wp-config.php file with most new database info)
6) Upload backed up theme to wp-content/themes directory.
7) Delete “Hello World” post and “About” page.
Import posts, pages, and comments via built-in Import function.
9) Fix your sidebar widgets where applicable.
10) Upload fresh downloads of all plugins you want to use, activate and configure.
11) Fix permalinks.
Please post questions in the comment section below!