I think my website got hacked

Your absolutely right. It seems that the config value is also used as a name prefix.

Sesion_files_driver.php:

Code:

$this->_file_path = $this->_config['save_path'].DIRECTORY_SEPARATOR
.$name // we'll use the session cookie name as a prefix to avoid collisions
.($this->_config['match_ip'] ? md5($_SERVER['REMOTE_ADDR']) : '');