Check if your site is hacked, as follows:

1. When hacking usually on site, new users with Administrator rights. Usually their logins drupaldev, drupal, system, but there may be others.

2. Quite often in the table menu_router site database insert malicious code. You can find it by doing a database query:

SELECT * FROM menu_router WHERE access_arguments LIKE '%form1(@$_COOKIE%';

When breaking, the attacker not only creates new administrators, but also downloads malicious files to the server.

If your site has been hacked, you must:

 - Remove all users with administrator privileges to which you have no relationship.

 - Perform a system update to the latest version.

 - Check the database for the presence of Trojans.

 - Find and delete all files created on a server containing malicious code. In this case, the malicious code can also be located in the files of the site. In this case, delete the file is not necessary, you just need to remove it from the part that contains malicious code.

Also, if your site has been hacked, you can order from us virus removal from the site, or scan your site for vulnerabilities.