My site was hacked. The hacker had added lines to the header.php file that produced links and other text (some english, some appeared to be russian) at the top of pages. Also added three files named above.
I've removed the lines and the files. Header lines are gone.
Embarrassing part, I was still running Atahualpa 3.4.6
Looking into plugin called "System edit restriction" -- as another tool to fight hacks.