[TheLastSuperman]

Originally Posted by dawges

This username appeared 4 times in the admin group:

Th3H4ck

Note the userid's of those 4 accounts, you may need them for reference later but as soon as you write them down delete those admin accounts and as Zachery noted then me as well, delete the /install/ directly immediately if its present.

*Stop for one second though and reply to my backup question above ^ Do you have a recent backup? If so its better to restore and nip any possible exploits in the bud. If no backups then continue on investigating and clearing out any malicious code/files/other.

Edit: I'm taking the family out to dinner but will check this when I return as I have work to do tonight regardless .