Rouge files found in Media Manager ~ Hacked?

[bertman]

Hello,
We maintain a site on 1.5 ( I know outdated). I noticed a higher than normal bandwidth usage lately. Although user registration is disabled, I found a new registerd user. I deleted them.
Also, I found two .php files in the Media Manager. I have since deleted them too, but would like some input on them. I have saved and attached as a plain txt file.

Am I wacked, or was this site compromised?

Thanks,

bertman

[mandville]

yes - you were hacked.
please follow the forum sticky, post the fpa and follow checklist 7,

[Slackervaara]

If you remember the name of the hacker files, so search for those name in access logs and you might figure out how the hacks was made. takes only a couple of minutes to check this.