I have been hacked on two hosts at the same time - looking for vulnerable

Hi there

There are only a couple of places where a gathering of my list of sites exists

Piwik
and
Google docs shared doc for my VA’s to work on my sites

The hackers don’t have to have gotten the passwords as they can get in through plugins

I am just checking that piwik is safe and hasnt got the suspicious ‘timthumb’ element in it which is causing major problems for wp sites

Or if its google docs?

Anyone have any ideas or feedback as I need to slam the door on this bunch before they do any more damage

started with spam email being sent out
then plugins started failing so two sites became inaccessible until they were removed
then ended with 3 sites redirected and finally 5 altogether
the redirects are nowprotect.ru and checkprivacy.ru

Anyone?