Thanks for the replies.

I've already confirmed with my hosting company that joomla was exploited and not the cpanel. I'm using the latest build of joomla 1.5, I've considered updating to 1.7 but due to my current templates and plugins not being compatable with 1.7 it would take a lot of time.

The last time I got hacked it ended up infecting some of the users machines, so I don't really want to do a few things and wait and see if I get hacked again tonight.

I thought the htaccess method would be best thing to do until I can get a new site built.

Thanks again