I’ve had a couple of sites hit by this, and spent a while cleaning up the mess. Now that’s done, I’ve been looking at the logs and all the accesses I can find so far for the hacked files are from two IP addresses, both in the same block:
194.110.162.23 and 194.110.162.79
The earlier accesses are with the .23 and later ones .79. The block is registered to extendedhost.com in Canada, though there is no website there I can find.
Will continue to dig a little and see what else I can find.
