Originally Posted by BestXXXPorn

Setting to 644 alone won't help you... What is the owner and group of the file? If it's set to the same as the webserver runs as then any exploit which is passing through your webserver will have full access to the file...

If someone has already hacked your box you have way more issues to worry about... First things first:

http://www.rootkit.nl/projects/rootkit_hunter.html

Download it, install it, run it, then you can rule out most root kits and learn if your box has been compromised or not...

If it has, you know the problem... if it hasn't then you can move onto the next step.

GL!