[support] website or database seemed to be hacked - help!!

[geniekids]

The body of many many nodes seemed to have been appended with a whole lot of
html content by a hacker - via a script
The content is appended with the html tag

which has lead to this content being there while not visible when the node
is displayed.

This content is being appended to even new nodes being created! - as if some
script is running.
How do i stop this?


See what is being added to each node in the attached text file

Also now when i access the website - i get the following error at the top

Warning: session_start() [function.session-start]: Cannot send session cache
limiter - headers already sent (output started at
/home/genie/public_html/index.php:2) in
/home/genie/public_html/includes/bootstrap.inc on line 995

Warning: Cannot modify header information - headers already sent by (output
started at /home/genie/public_html/index.php:2) in
/home/genie/public_html/includes/bootstrap.inc on line 596

Warning: Cannot modify header information - headers already sent by (output
started at /home/genie/public_html/index.php:2) in
/home/genie/public_html/includes/bootstrap.inc on line 597

Warning: Cannot modify header information - headers already sent by (output
started at /home/genie/public_html/index.php:2) in
/home/genie/public_html/includes/bootstrap.inc on line 598

Warning: Cannot modify header information - headers already sent by (output
started at /home/genie/public_html/index.php:2) in
/home/genie/public_html/includes/bootstrap.inc on line 599
); ?> ); ?> 


http://www.nabble.com/file/p23020939/html%2Bforeign%2Bcontent.txt
html+foreign+content.txt 
-- 
View this message in context: http://www.nabble.com/website-or-database-seemed-to-be-hacked---help%21%21-tp23020939p23020939.html
Sent from the Drupal - Support mailing list archive at Nabble.com.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.drupal.org/pipermail/support/attachments/20090413/b5160a47/attachment.htm>