Site Hacked

Over the wknd someone hacked my site. Everything’s up to date and I’m only using two plugins.

All that seemed to happen was they delivered an unstyled link to possibly their / malicious site from every post of mine.

I simply reinstalled wp and it removed the link. Though a load of files on my remote space were created. They had nonsense numerical names and contained basic numbers ie “0.9”, is that related?

I’ve checked my server log and someone accessed the wp-includes folder, details below around the day it was attacked….

/wp-includes/js/comment-reply.js?ver=20090102
Http Code: 200 Date: Nov 21 20:16:53
Referer: http://www.mysite.co.uk/wp-includes/js/comment-reply.js?ver=20090102
Agent: Mozilla/4.0

Anyone know anything about a similar attack? Is the comment-reply.js vunerable? Should I alter all my passwords?

Any ideas welcome. Thanks.