2
The first file that normally gets loaded when a user goes to a XOOPS site is /index.php. You may want to check to see if they put an index.htm(l) page in your directory. Many servers will execute an .htm(l) document before a .php document.
You will need to try and figure out how they got into your server or it will happen again. Repairing the files won't be sufficient to stop them from repeating the 'attack'.