Thanks Stephen..
I did change all passwords...CP and FTP, I'm next working on changing database passwords...I little bit more work because of settings and config. php files.
I have no clue on how to find any hidden script in any other files on the server so I will start to upgrade or...