ok. good to hear. So the pool server software is ok and not compromised or file timestamps changed for the code? So this was one back door, could there be others or you got them all plugged up?
Everything is running fine now, even was able to change the ID so that when you receive a payment it will say Noobpool instead of just the wallet address. And I did find the issue and fixed it. Doesn't look like there are any other vulnerabilities. The good thing is that the software is set to start sending out payments as soon as we find a block, so that will keep any thief from being able to get much if any if they somehow found another way to hack us. I've also setup alerts so if there are any unauthorized transactions I'll be alerted right away on my phone, which is always with me. Since they do a test transaction first of 0 eth, then start to take money several minutes later it will give me enough time to protect any eth in the account. But I doubt that will be an issue again anyway.
And as a final measure of safety, I'll move any excess eth to a secure wallet on another system then I can move it back when it's needed, until i'm confident that we are safe from more attacks.
I'm not giving up on finding who did it though, they only got about $100 worth of ETH, there has to be some IP fingerprint somewhere and when I find it and track them down, I'll go to their house and rape them. Literally. They steal from me it becomes prison rules.