BuddyPress.org

@gregfeilding time to dig in the access logs. see if you can find the dates on the extra files, or on the changed files & cross-check them with the access logs at the same time.

I do know of someone who got hacked via *Windows* which them infected his installs via his ftp program. most of the hacks fo this type that I have seen haven;t been via any wordPress files, but the box itself or hacking the ftp password. Use sftp instead.