I'm trying to figure out how, but someone installed a different Photopost classified's tables into my database with a different prefix and then changed the config file to point to that database. There was nothing really in the new database just a complete set of PP Classifieds tables and in the settings file everything had been pointed to
www.domain.com.
I'm removing all the code, but it looks like ONLY the config file was changed and the database.
Obviously, I'm change ALL passwords on my severs today.
I received an email from a guy in Zambia today that in very brief terms complained that Zambia has been banned via IP address bans (all of Africa).
I can't help but think that these things are linked.