I just dealt with this… The wp-config file was renamed bad.wp-config, I renamed and accessed it. The database settings were changed and the DB name and password now ended in “FCK”, and the . There were a couple of files (wp-crawl.php and wp-crawl.php.1 and installer.log.txt and wp-snapshots) that appeared this morning at 8:52 am. Cleaned out the site, reset the users, changed the salt keys, etc…
