new admin created without permission

Hello

A new admin created without permission, in several sites i manage, i suspected some plugins. i need your help to determine where the hack is begin.

i found also some malicious code in “index.php” and some inserted php files.