First, if there's a rootkit, you're probably fighting a neverending fight. Take the server offline and reinstall and restore backups that are pre-infection. That's the "best" method of fixing.
Second, were you up to date on patches and such before the infection or did you patch after?
Third, what custom code is running on the server outside Plesk? How do you know that was even the infection vector?
Without auditing and sandboxing, you're going to have a hard time telling what happened. If there's a database running on it, someone could have faulty code on the system. If someone else has access to the server, maybe they did something to infect it. Are the websites running with different file permissions to silo possible damage? Or are the sites pretty much sharing all the resources? Are other users involved and able to run scripts? Do they have different widgets and whatnots installed? Were the files timestamped, so you could go back into the logs to try to glean what happened?
If the logs are on the same server that was compromised, the logs could have been altered as well.
In the end, the best thing to do is take the server offline and fix it by reinstalling from backups. Otherwise you can't fully trust it. And if you have any "personal" data (user passwords?) they need to be informed that their information may have been stolen. Then start setting up some kind of auditing on the system, and send logfiles to a secondary server over a safe channel of communication so logs can't be erased by an intruder. And run some kind of file checking utility like Stealth on another server to monitor your file integrity and warn you of changes.
Without knowing what else your server runs, there's little other people can do to tell you how it was compromised.