Thanks Stephen..
I did change all passwords...CP and FTP, I'm next working on changing database passwords...I little bit more work because of settings and config. php files.
I have no clue on how to find any hidden script in any other files on the server so I will start to upgrade or...
OK I’m a believer. I’m pretty sure they got in through my laptop because the domains affected where ftps on my computer and clients that I didn’t need ftp connection to where not affected. The hack replaced only the index page on 12 websites (html and php)
I run updated...
I had three domains hacked..All three domains are on the same user account (cp) and they are the only domains on the account. All three domains are Wordpress blogs on a Linux box. The hackers changed the index.php page (only) with their trophy page of success.
Now I need to figure out how...