Stats file hack

I work with a number of WordPress sites. Two sites – artsonetheave.org and lookingcloser.org — have recently been hacked via the stats file. In one the stats file was in wp-admin and in the other it was in wp-includes. The hack creates HTML in this file which points to a Viagra site. Then that HTML shows up in Google when people search for the site and in Facebook when people put the site in the Post link box. It has re-occurred on one of the sites. Have you seen this before, and is there something I can do to stop it re-occurring? I’ve searched for threads on google about it, but I can’t find anything.

Thanks,
Sam Drew