[slodave]

Two scenarios.. One, they just moved a page or two around and that's it. The hosting service needs to make sure that all of their SW is up to date, web, ftp, ssh... Any of those can be compromised and end up where you are.

The other is that the page was changed AND other SW was installed, such as IRC, or client SW to turn your server into a torrent provider...

If it's the latter, you need to search the directory carefully, they usually hide their dirs... I'm guessing that your provider is using Linux for there severs. If dirs were setup, you would see something like... .src .xyz .(something) It will be random.

I'm going to say that you just had one or two pages changed and nothing more. This type of attack is usually only to rack up points amongst the hacker wannabe's.