I'm currently rebuilding one of my sites with the multilanguage hack. During this time I have closed my site so I'm the only one to have access.

Today, two icons in the admin section belonging to the spotlight module and the blocksadmin module where replaced by weird pictures (one looking like a drop of lava, another one with a screaming face). The only thing I can think of is that someone hacked into my site. I replaced the module files and all is ok now, but how can I find out whats happening here ?

I'm running XOOPS 2.0.10 MultiLanguage, downloaded from the smartfactory website.

Any ideas ?

EDIT: when this happened I had the option to use template changes switched on in my settings. I've switched it of now.

Might be good to find out whether the new images are on your server on whether they link to another location, then you know whether it was your database or site dir that was compromised.

It's clearly my site dir that seems to be compromised. Just now the icon for spotlight had vanished and the icon for newbb was changed. However, the picture replacing it is some 'put your link here' logo, so it seems strange that some hacher would put such a harmless picture there. Nothing else is compromised, just another picture.

I remember something like this happening to another XOOPS site of mine in the past and I seem to remember it was some server-side screwup where another xoops-install on the same isp server was interfering with mine. Maybe this rings a bell for anyone ?