Cheers.
My recent post UFCcom blacklisted by Google indirectly

– This is for NTEXT ONLY
DECLARE Col_Cur Cursor
FOR SELECT COLUMN_NAME From INFORMATION_SCHEMA.COLUMNS
WHERE Table_Name = @TableName and DATA_TYPE IN ('ntext')
OPEN Col_Cur
SET @OutStr ='UPDATE ' + @TableName + ' SET ' ;
SET @ColCnt = 0;
FETCH NEXT FROM Col_Cur INTO @ColName;

WHILE @@FETCH_STATUS = 0
BEGIN
SET @OutStr = @OutStr + @ColName + '=CAST(REPLACE(CAST(' + @ColName + ' AS nvarchar(max)),''' + @str + ''','''') AS ntext),' ;
SET @ColCnt = @ColCnt + 1;
FETCH NEXT FROM Col_Cur INTO @ColName;
END
SET @OutStr = LEFT(@OutStr, LEN(@OutStr) – 1) + ';'
IF @ColCnt > 0
BEGIN
PRINT @OutStr ;
END
CLOSE Col_Cur;
DEALLOCATE Col_Cur;

Hopefully I'll have some time soon to fix the root cause, but for now, at least I can clean up the damage.

Oh, and to clarify, this generates the UPDATE statements, which you then copy,paste, and run to actually clean the database. When you are pissed about the fact that your db is hacked, you may not realize that at first in your moment of anger