Yes Nico,
I started reading other threads and across one where the problem was similar to mine (same hacker) and the change was made to the default theme file (adsimple in my case). A re-install of the theme fixed it but took away the customizations that the original creator of the site did, so I used a different theme that best matched and preserved the original look and feel.
In any case, I realise this is not a solution (though the site is indeed up). The site has been hacked twice this year – the first time was a simple fix, just replacement of the index file, but I fear something drastic might happen in the near future. I need to beef up security but have no idea where to begin.
