Also wowhead, look in your cache and backup directories specifically. All this security you are setting up may be locking the door after the thief is already in the store. When my sites were hacked they did pretty much what you described, I guess to stop me from loking deeper. If they were in then they probably already have set up the scripts somewhere to let them keep coming back. Although DosDawg helped me lock the door on my old hosting, they already had a key to the backdoor. End solution, see more I had to completely move off my poor hosting environment, moved in with Dos, and Sammie, and they keep all the door to door salesmen away!