he actually came back and did it again right after I posted and I fixed it again and banned his ip address again. From google analytics real time reports I can see he is in Saudi Arabia so I'm keeping an eye on any more requests from there, I'm sure he will be back this has been going on for a few days now, every morning I find he has done it and posted some hacker bragging in Arabic. It is silly really, I'm so impressed with his ability to deface a site that lets you login as administrator. Just wish he would get bored with it and go away.