Some odd hacking attempt

Hello!

Today i decided to make a backup of one of my client’s site and all of a sudden found in the root folder of the site the file albanian.php (live)!

Also i found that files options.php and wso.php look a little bit odd, you can see there some utf-8 encoded text mixed with PHP, isn’t it odd?

The most strange thing is that nothing else has changed: FTP passwords are not changed, wp-admin passwords are not changed, mysql passwords are the same as i left them and that’s it.

This is the first time someone hacked me)

Have this happened to some of you, guys?

Also, pls tell what i can do to protect my site, how to find security hole which this albanian nuttah has came through ? Does wp has some plugins or maybe built-in instruments to find it out ?

Thanks in advance!