hello
thanks for the prompt reply.Yes, same people, they hacked the websites as they were on one shared hosting. I contacted our host, they never replied neither looked into it, we wanted to know how they did it before we deinstall and reinstall , but your post saved us some time