my wordpress site got hacked

A few weeks ago I upgraded to the latest 3.2.1 release of wordpress. Of course like everyone I’ve a few what I’ll call core plugins I require. The most recent of these to get added to my list is Donncha O’Caoimh’s http://ocaoimh.ie/exploit-scanner/ Of course when I installed it at the same time as installing the 3.2.1 release of wordpress the hash files weren’t available for 3.2.1. This lead me to lots of False positives. Yesterday then when I scanned I for some reason thought I was seeing the same thing. I mean upd.php and config.php seem like two perfectly normal files...