I just noticed that - not quite sure - oh wait - yes I do know - the host we used was hacked - we just restored files back to 9/29 - so that's what happened.

Earthwaves itself wasn't hacked, but other sites using php files all were hacked and redirecting people to some russian sites..

The trick it to figure out how we got hacked and why - changing passwords didn't help any - I've been madly checking permissions and all files on multiple 'add on ' domains that we have under this one account..

I've also changed the settings for php on our accounts to stop execution of certain functions -

Our provider is USELESS in this situation even though there is something allowing the russians into the server and at the same time locking US out of our ftp accounts.. (bluehost did the lockout since we had so much activity - DUH! we're trying torestore the darned site..)

So I apologize - 2 weeks did get lost..

Canie