Upload Hacked

I was using version 2.8.4 and noticed none of the images were showing in my posts. In the status there were numerous attempts to connect to a website g-oogl-e.com. I tracked this down to an .htaccess file that now exists in the uploads>YYYY>MM folder.

I’m unable to delete it (permissions issue) and have contacted my host to remove them. One exists in every month folder. I’m trying to work out how the files were put there. I’m presuming through the wordpress interface as none of the other folders in my website are affected by this.

Anyone heard of this or had any experience with it?