[kh99]

I'm not an expert on this kind of thing, but: check the plugin manager for any plugins you don't recognize - you could also try disabling plugins and see if that removes the malware (if it does you still need to find the plugin, of course). It wouldn't hurt to re-upload all your vb files (assuming you haven't made any changes to them of course). And there's also this script: https://vborg.vbsupport.ru/showthread.php?t=220967 which recompiles any templates where the compiled version has changed (someone with access to the db can hide stuff in the compiled templates that you'll never see unless you look in the database). That mod is for vb3, but I think it just needs a minor change to work in vb4 (I posted the change in post#74 of that thread).

ETA: oh, also you can run (from the adminCP) Maintenance -> Diagnostics -> Suspect File Versions to make sure there aren't any files on your server that shouldn't be there.

Of course the most important thing it to try to figure out how the stuff got there in the first place or it's likely to happen again after you clean up. At the very least you should change your passwords, I would think.