johnnykane

Hey there. We came across this on one of our client sites. It’s pretty much as the lads described above (ftp compromised etc). We’ve written up a blog on it to help others out.
http://www.cubedroute.com/weblog/website-virus-removal-and-post-mortem/