Well, I've reported the problem already as a hacking report, but unfortunately it doesn't look like we've made any progress. The board is being hacked daily since a week or so with multiple files being replaced, now even Google picked up on it and marked it as malware.
The board in question:
http://www.santharia.com/advVersion: SMF 1.1.18
I've replaced various infected files again with working versions (as I did ca. 6 times already), so for now it looks ok for the next hours. But there's a security hole somewhere and they'll strike again for sure. Passwords have all been replaced, suspicious non-SMF files have been eliminated, log files have been sent to you support guys. Are the permissions to the folder not correct? Is there a script that can fix this? I badly need help here.
The only thing I can think of is that the problem might be the TinyPortal mod, which still seems to be at v0.9.8 and there's a v1.075 version already. After the last hack the Administration Center however cannot display the version number correctly for some reason and always writes "You are unable to connect to simplemachines.org's latest news file." While it works perfectly fine on the other SMF board I have. Even if this would work, the v1.075 version apparently requires that the old version is uninstalled and I don't have that link in my Packages list, only "Delete" and this is something different.
So any help would be appreciated, as right now there's little light at the end of the tunnel and the situation is likely to get worse.