It was so nasty, every single site on my web host account was hacked. The hacker was able to modify every single files and put their spam links every where. It took me a whole week to clean up those rubbish.

The explanation from my host provider Host Gator was the hacker used a hole in my WP 2.6 to access all files on my account, thus an upgrade from version 2.6 and below to version 2.8.6 is essential if you are  running a WP blog. Please do it, or at least back up your web sites, and it could save yourself heaps of time when such incidence strikes.