How to distinguish between a hack and an encoding error?

Question

This morning I was working with a new image gallery plugin. After two hours of working with it, our server was struggling with a heavy network traffic, and then the server appeared to go out. Shortly before it went down, I disabled the plugin because I was getting DB connection issues and thought it might have been a compatibility issue. The DNS switched over to the backup server. When I went back to the orginal server, there were some very minor code differences on one page. This section is taken from php template and not what was rendered.
Below is an example:

Previous:

<p>Derpa Derp. Derp's like to derpa. Foo bar derps continue to inspire us all.</p>

New:

<p>Derpa Derp. Derpâ€Åâ€s like to derpa. Foo bar derps continue to inspire us all.</p>

Whenever the server had gone out before this had never occurred. I looked up online there is an old Java virus that behaves similar to this. Alternatively, I've heard of an encoding issue whereby the ANSI switches to UTF-8 and makes things look weird. This weird string is nearly identical to what was shown.

Answer 1

If you have checked your database entry of the page/article, you will see that it is a issue on Database side, or by any means there was restoring going on because of the crash, that could be an issue or a restoring plugin/script with a bug why a simple character as ' gets messed up.

And could you tell in how many cases the character ' got replaced by â€ņ?

Additionaly about the high usage etc, there could be a backdoor in the plugin etc, or someone searched for that plugins dorks and used an exploit but still you've would see much more HTTP activity and Web server load, you should check webserver logs of that time activity.

By finding out what was going on, only then you can rule out hacking., i will update my answer, if you will provide more details.