Compromised D7 Sites due to SQL Injection Security Bug "Drupal Core - Highly Critical - Public Service announcement - PSA-2014-003"
Someone recently came out with a module that should help in this, assuming you have installed drush.  It is called Drupalgeddon

Here is an example of its use:

$ drush -y @sites drupalgeddon-test
You are about to execute 'drupalgeddon-test' non-interactively (--yes forced) on all of the following targets:
sites.abcd-d6.example.org       &gt;&gt; Site is not Drupal 7.                     [ok]
sites.abcde.example.org         &gt;&gt; Site did not test positive. Good luck!    [ok]
sites.abcdef.example.org        &gt;&gt; Site did not test positive. Good luck!    [ok]
sites.abcdefg.example.org       &gt;&gt; Site did not test positive. Good luck!    [ok]


Also note:

Drupalgeddon cannot guarantee a website has not been compromised.