Drupal Reports about Security: .php file in my url

What kind of a message is it in the watchdog? If it's a 404 error then don't worry. That's typical for bots to look for vulnerabilities on your server which may not exist.

The files monatsblatt.php and datumscalc.php are not related to Drupal. If you have these files they got on your server in some other way.

If you are interested in security, I suggest you read:

• Secure configuration for Drupal sites
• Writing secure code which is also valuable to understand so you can audit the modules you install.
• Drupal security team which contains information about the project's policies like what to do if your site is defaced
• Drupal Security Report which is the first report to try to tackle the question of whether Drupal's software and security team are mature enough to be deployed in your organization.
• Cracking Drupal the only book about security in Drupal, which is now available (disclosure: I'm the author ;))

And I suggest you use: security review module which helps to detect some problems that are described in some of the resources above.

I recently worked a drupal site for a client, i found 500 hundred plus page not found in the site reports which contained some very disturbing content (mainly unmentionable degenerate keywords for every type of porn search possible) the website was drupal 6.19 very out of date and un secure including every module in the website. Google wont index any pages from this website is it possible i has been blacklisted or just being ignored by google. I might recommend we move the site to a different server and change the domain name slightly. In all my years of working with website i have never seen anything like this before. This may be from amateurs that think the can build a website and just abandoned him after the site got into trouble.

Any ideas on what may have happened to my clients website