Ruben,
thank you for the housekeeping ideas, but the site is safe. It was some hacker that exploited a know issue that was already fix on the UBB forum.
nobody is hacking it any more, but I still have those disgusting left overs from that attack
Any ways, I did all this when I recovery couple months ago:
1) changed my password from the control panel (I'm the only one accessing it)
2) changed username AND password for the mySQL database.
3) deleted the FTP account that I was using to access the server.(created a new one).
4) the master account login is changed every 25 days, plus or minus 3.
The files there are already fresh, from a .ZIP, plus some small changes Rick did.
THe only file that is old is the language file, that I went trought very carefully, checking one by one, to make sure that the Portuguese files I have there are not corrupted.
So, this is why I'm surprise that I still have this kind of issue there.
Do not know where else to look for clues.
