Site hacked 24 hours ago, still problems

[kh99]

Originally Posted by pjkcards

I just ran this query:


And it returned A1.jpg (see attachment).

The last plugin listed in you image A1.jpg look suspicious to me. You could try disabling it or post the code here so we can see. The "Smilie Window Redirect" looks a little suspicious as well, but it says it's part of product adv_cmps and I'm not familiar with that, so it might be OK.