They where hacking in the ftp if i am not mistaking i saw so in the ftp sesion control, ofcource i directly disconected them into my user panel, and changed passwords and stuff.