today when i go to xoops.ir i see someone removed me from admin groups and send a news about attack site.

i have xoops 2.0.14 and protector is installed

in protector logs i found these logs:

82.99.232.94
Firefox/2.0Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1) Gecko/20060918 Firefox/2.0 UPLOAD Attempt to upload icon2.php.

82.99.232.94
Firefox/2.0Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1) Gecko/20060918 Firefox/2.0 UPLOAD Attempt to upload tmp.php.

how can i found the problem?

after that i set costum sessions to "NO" also i removed other admins from webmasters groups.

now could you help me about this?