It looks like they are adding a div called <div class”listhead1″> and putting their code in there.
I’m going to start by changing username/passwords and start searching for where they might have hacked me. Any expertise and advice would be appreciated.