iis secure, htaccess hack?

Hello All and seriously thanks for your help. Following Aaron Wardle’s advice I double checked the WWW log. Sure enough matching the time stamp on the injected files was a request to phpmyadmin/setup.php. Search revealed a known hack and after a directory rename and setup.php removal I bet we don’t get hacked anymore.

Thanks again!

Only just seen this message, glad you got the problem resolved.

Thanks Aaron