It seems my Concrete5-based site has been hacked - found this in my default and homepage templates footers:
<div style="position:absolute;left:-6397px;"> <a href="http://pleasantvalleywinetrail.com/order/antibiotics.html">cheap Antibiotics</a> ... many more <a>s ... </div>
Has anyone else come across this? Any idea how the site might have been compromised? I've changed FTP and c5 admin passwords but would appreciate any advice on reducing the odds of this happening again. It's 126.96.36.199 by the way.