I have found that I have a similar attack to the one mentioned here

[giant regex hack](https://stackoverflow.com/questions/3328235/how-does-this-giant-regex-work)

The file keeps getting recreated and I cannot see from where its coming. How can I fix this? Anyone with a similar experience? I am running joomla 1.5.25

How can I trace the script that includes this file? How do I secure the site?