How is my website infected? My web server company recently reported me that my website is sending spams. I scanned the whole file system and found a number of infected php files like index.main.php, ipopup.php and  wtm9309n.php in sites/default/files directory.

All permissions for files and directories are set correctly. I have only one custom content type having 2 textbox fields that all users can create a new content of that type.

I checked the files table in database. except my uploaded files, there was no other files listed there, so (I think) that means the infected files are not uploaded via upload forms.

This is the only infected website among of the tens in my web server, so I think this a problem with this website instead of other things like OS vulnerabilities and ...

Enabled modules:


admin 
cck 
contact_forms 
faq
filefield
imageapi 
imagecache
imagefield
imce 
nice_menus 
node_export 
views


Any suggestion? (Drupal 6.20)
There really isn't a lot to go on here.  You really need to try to match up the ctime (creation timestamp) on the malicious files with the Apache logs to see what may have happened.

Other than that, you should


Take a backup.
Do a yum update on your server to make sure you have all relevant patches.
Clean out your temp folders on the server, and reboot it.
Bring Drupal core up to date.  You are several versions behind, and have other security vulnerabilities.
Bring your contrib modules up to date.
Double check all permissions that may involve PHP input, like the PHP input filter, block visibility rules, view rules, etc.  To be honest, I would disable the PHP input filter altogether.
Audit your custom code to see if there are any problems.