The owner of www.gazeta.kg and www.kyrgyz.us Ulan Melisbek answered to us.
He was phoneinterviewed by me right away (7 min 47 sec talk duration).

Till september 2004 was a lot of attacks/scans and hack endeavours.
2 was successful.
FIRST was at octobre-november and second in february 6.
At first hack was (by word his webmaster at that time) a big scan, and one of the open ports had an vulnerability ( hi can say what and how).
Hackers penetrated in to hosting , change the OS kernel and put  some backdoor that corrupted all files that named index.php or index.html and defaced it with page contains foul language words, but MYSQL base was not damaged and they repaired all content after a time by hands ( if I understand right they havent a backup copyes whole hosting, only several sites).
After that till just now, the have a lot of attempts of port scannings and every day blocked this Ips (hosting based on some Linux with iptables, and I think with snort or someth else).
SECOND successful hack was in Feb. 6.
Hosts was defased and again index.* files was crashed. MYSQL with information was not touched.
He is not advanced techical user, and couldnt explain for me details of hack, but by his words in this case its vulnerability in PHP (PHP-nuke engine)graphics module. He said that all backdoors that worked in system was in folder there locates graphics conetnts of kyrgyz.us and gazeta.kg.
Unfortunately he did not keep any logs, becouse he have tons of information in his mailbox, a lot of work and not attached importance to this fact.

To the future I asked him to keep any information that he will be get or catch both about his sites and about other.