Still under attack, found a trace now, definatly the hacker is entering through the admin screen.
Doesnt seem to matter which Joomla! version or pw changes. i've been hacked on: 2x 1.5.23, 1.6.1, 1.6.3, 1.7
found logs!
184.154.223.130 - - [31/Jul/2011:17:54:04 +0200] "GET /administrator HTTP/1.1" 301 429 "-" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2)"
184.154.223.130 - - [31/Jul/2011:17:54:05 +0200] "GET /administrator/ HTTP/1.1" 200 4156 "-" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2)"
184.154.223.130 - - [31/Jul/2011:17:54:07 +0200] "GET /administrator/templates/khepri/css/rounded.css HTTP/1.1" 200 2495 "
http://fightershub.com/administrator/" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2)"
184.154.223.130 - - [31/Jul/2011:17:54:07 +0200] "GET /administrator/templates/khepri/css/login.css HTTP/1.1" 200 1952 "
http://fightershub.com/administrator/" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2)"
184.154.223.130 - - [31/Jul/2011:17:54:07 +0200] "GET /administrator/templates/system/css/system.css HTTP/1.1" 200 1131 "
http://fightershub.com/administrator/" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2)"
184.154.223.130 - - [31/Jul/2011:17:54:07 +0200] "GET /media/system/js/mootools.js HTTP/1.1" 200 74434 "
http://fightershub.com/administrator/" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2)"
184.154.223.130 - - [31/Jul/2011:17:54:15 +0200] "GET /administrator/templates/khepri/css/general.css HTTP/1.1" 200 15582 "
http://fightershub.com/administrator/" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2)"
184.154.223.130 - - [31/Jul/2011:17:54:17 +0200] "GET /administrator/templates/khepri/images/h_green/j_header_middle.png HTTP/1.1" 200 385 "
http://fightershub.com/administrator/" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2)"
184.154.223.130 - - [31/Jul/2011:17:54:17 +0200] "GET /administrator/templates/khepri/images/h_green/j_header_right.png HTTP/1.1" 200 366 "
http://fightershub.com/administrator/" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2)"
184.154.223.130 - - [31/Jul/2011:17:54:18 +0200] "GET /administrator/templates/khepri/images/h_green/j_header_left.png HTTP/1.1" 200 5148 "
http://fightershub.com/administrator/" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2)"
184.154.223.130 - - [31/Jul/2011:17:54:18 +0200] "GET /administrator/templates/khepri/images/j_button1_next.png HTTP/1.1" 200 1507 "
http://fightershub.com/administrator/" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2)"
184.154.223.130 - - [31/Jul/2011:17:54:18 +0200] "GET /administrator/templates/khepri/images/j_crn_tr_light.png HTTP/1.1" 200 252 "
http://fightershub.com/administrator/" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2)"
184.154.223.130 - - [31/Jul/2011:17:54:18 +0200] "GET /administrator/templates/khepri/images/j_border.png HTTP/1.1" 200 213 "
http://fightershub.com/administrator/" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2)"
184.154.223.130 - - [31/Jul/2011:17:54:18 +0200] "GET /administrator/templates/khepri/images/j_button1_left.png HTTP/1.1" 200 483 "
http://fightershub.com/administrator/" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2)"
184.154.223.130 - - [31/Jul/2011:17:54:18 +0200] "GET /administrator/templates/khepri/images/j_crn_br_light.png HTTP/1.1" 200 253 "
http://fightershub.com/administrator/" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2)"
184.154.223.130 - - [31/Jul/2011:17:54:18 +0200] "GET /administrator/templates/khepri/images/j_crn_bl_light.png HTTP/1.1" 200 246 "
http://fightershub.com/administrator/" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2)"
184.154.223.130 - - [31/Jul/2011:17:54:19 +0200] "GET /administrator/templates/khepri/images/j_crn_tl_light.png HTTP/1.1" 200 247 "
http://fightershub.com/administrator/" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2)"
184.154.223.130 - - [31/Jul/2011:17:54:19 +0200] "GET /administrator/templates/khepri/images/j_login_lock.jpg HTTP/1.1" 200 2536 "
http://fightershub.com/administrator/" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2)"
184.154.223.130 - - [31/Jul/2011:17:54:19 +0200] "GET /administrator/templates/khepri/images/j_bottom.png HTTP/1.1" 200 232 "
http://fightershub.com/administrator/" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2)"
184.154.223.130 - - [31/Jul/2011:17:54:19 +0200] "GET /administrator/templates/khepri/images/j_corner_br.png HTTP/1.1" 200 314 "
http://fightershub.com/administrator/" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2)"
184.154.223.130 - - [31/Jul/2011:17:54:19 +0200] "GET /administrator/templates/khepri/images/j_corner_bl.png HTTP/1.1" 200 303 "
http://fightershub.com/administrator/" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2)"
184.154.223.130 - - [31/Jul/2011:17:54:20 +0200] "GET /administrator/templates/khepri/favicon.ico HTTP/1.1" 200 1150 "-" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2)"
184.154.223.130 - - [31/Jul/2011:17:55:36 +0200] "POST /administrator/index.php HTTP/1.1" 303 - "
http://fightershub.com/administrator/" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2)"
184.154.223.130 - - [31/Jul/2011:17:55:37 +0200] "GET /administrator/index.php HTTP/1.1" 200 17436 "
http://fightershub.com/administrator/" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2)"
184.154.223.130 - - [31/Jul/2011:17:55:39 +0200] "GET /includes/js/joomla.javascript.js HTTP/1.1" 200 15405 "
http://fightershub.com/administrator/index.php" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2)"