Hacked, & one of my permissions keeps changing back?

[ladolcevideo]

Apologies in advance, but I have a specific question. My site was hacked by bored removed] and I can't figure out where the file is that they're using to replace all of my content (my content is all there where it should be in the backend). I ran the forum post assistant and saw that 3 folders had the wrong permissions. Two were for something called galleryvideoplayer, set at 777, which I immediately changed to 755. The other is the folder logs > forensic, which I tried several times to change from 707 to 755, but each time it immediately changes back to 707. Maybe this is what it's supposed to be and this is a stupid question, but why is it not retaining the permissions I set via ftp? I know it's my fault for not updating joomla obviously, but is this a normal thing? Here's what the fpa says:

[Mod Note: FPA Information removed per the original poster's request]

[johans]

try to update your site to last version 1.5.26 but you need to find the code first.

[ladolcevideo]

Thanks. I was planning to migrate to 2.5 when I've got some free time but can not find this bloody malicious code anywhere. Sigh. I found this about the group that hacked my site, not sure if it's true or even necessarily what it means: "They arn't even hackers, this group. They just use metatags and put in codes into certian functions of a site to mess it up." Sounds like hacking to me? Does this give any clue as to where I should look?

[ladolcevideo]

Any moderators around here who can tell me how to delete this post or get rid of identifying information in it? I fixed the site, I had just looked everywhere but the simplest place. D'oh! I saw that an "assumed nationality" was deleted by a mod - I only assumed because they put their flag on the page, declared that they were from that country, and redirected to their facebook page which was all people from that country. Which is a country I have nothing against, I just thought providing that info might be helpful if someone else had a previous run-in w/ this group and knew their M.O. Is pretending to be from a different country something that hackers do? I hadn't thought of that, but I guess it would make sense, for the lulz.

[mandville]

Any moderators around here who can tell me how to delete this post or get rid of identifying information in it? I fixed the site,

please use the report icon on the post and detail what you want removed.