Site hacked... details

ouch!

I checked the perms on my index.php:
# ls -al index.php
-rw-r--r-- 1 apache apache 872 Feb 4 13:22 index.php

and as you can see the user apache had (past tense) write permissions!

a quick chmod fixed that:
chmod u-w index.php

the following also had write perms:
update.php
xmlrpc.php
install.php
cron.php
robots.txt

all of which are probably a no no.

to view all of the files on your site that have write perms:
find -L . -perm /u=w,g=w,o=w -type f ! -iwholename './files/*' -prune -print0 | xargs -0 echo

this prints out all files (not directories) that have write perms (excluding the files directory)
I believe apache will still need to have write perms for the files in files

to ensure your site is secure, in that no one (but root) can write:
find -L . -perm /u=w,g=w,o=w -type f ! -iwholename './files/*' -prune -print0 | xargs -0 chmod ugo-w

I just ran it on one of my sites and it didn't seem to break anything...?

-al

yes you can use one from a new installation, in future make sure chmod permissions are set to 644 so that the file can't be written to.

What version of Drupal are you running ?

I'd double check my FTP program to insure its update to date, in the case that your FTP program is somehow uploading all files to 777.

I'd also check my apache logs to try and narrow down when this happened.

It appears that your webserver was hacked. It's not a Drupal security problem, but rather a poorly configured server.

Why are your Drupal files owned by Apache? They should be owned by your user account, not by the webserver. The only files that should be writeable by the webserver are those in the files directory, which represent user uploads.