got hacked - scripts running as "nobody"?

[graficalicus]

yep - we got hacked. Not from 4images, but 4images is the only part of my site I'm having trouble getting back online.

My host has now banned any scripts running as "Nobody" - but I don't know where to look to find what scripts are running as "Nobody" - can anyone help? Luckily I have a complete backup of just a day or two before the hack, so I'm not losing too much - just can't get the config to work again.

(ERROR! CODE 500 shows up on all gallery pages - my host says this is because of the new ban on "Nobody" scripts - ) - -

Help?!  Thanks...

[V@no]

well, if your host is banning "nobody" users, why dont they just change every single file under your account to your account? I dont think u can do anything through ftp without ssh access.

[graficalicus]

why dont they just change every single file under your account to your account? I dont think u can do anything through ftp without ssh access.

I think I'm changing hosts. Lots of problems lately with uptime with this one.

=>*EDIT: The sub-pages are working (i.e., this one for a specific category ) but the "main" pages alone aren't: index.php, categories.php &  details.php - I just get the 500 code - - any quick thoughts?
 I'm running this as a sub-domain off my main site - would that make any difference?

thanks - 

[graficalicus]

*UPDATE*

Apparently it's all about permissions - changed index.php to 755 from 777 - - everything's back in order..... for now..

[V@no]

yeah, a good start check our your host's FAQ  that is common setup