I think my website got hacked

Strange thing is in your config you have this:

PHP Code:

$config['sess_cookie_name'] = 'ci_session'; 


Meaning the session filenames should start with ci_session follow by the session_id. And that is also not the case.
Are you the only one working on this project? And if you can, check the current online version to a version that was working before this error started

Hey Martin ,
yes I'm the only one person who is working on this project. actually it was the online version that I've post.
i think my website was working for 15 days and then that happened! But my tech support from the server said: I've update your php version from 5.4 to 5.5 so the problem solved!

How does updating to 5.5 solve this issue? You did not have this issue at first when it was already running under 5.4. So I think your hostingprovider must have changed something. For example, the default session path under 5.4. Still does not explain why it is not being prefixed with ci_session