my wp sites got hacked, via script injections! Step 2: diagnosis, calmly