From what you describe, your website was hacked, injected not the PLESK server. If they have added in your httpdocs folder a file, this means your website is vulnerable to injection. I am almost sure you have an OpenSource software like Wordpress, Joomla, etc.
Question is now, they have...