Hi,
I’ve notice the same hack problem on my ftp. Something added that <img /> tag in most of index.php files on the server, created .log/ directories and put few .php and .htaccess files like “girl.php” “southpark.php” etc with some mod_rewite rules in .htaccess. I don’t have the exact source code, because I’ve deleted it as soon as I spotted it.
I had an older version of WP installed in subfolder of my server, but I’ve never published it. Whole attack took place on the 21st of April.
Hope you get some more info on that crap and help to identify the source.
Best regards
Batat
