mpower

Yeah, I told my customer to change FTP/SSH and database passwords already ... Thanks!

I took a code backup and deleted the old code which made it work again. Thanks for your answers guys

Yes, I am the sites admin (should have mentioned that 😀) and I want to replace the infected files with the none infected version. If I knew the paths to the files(s) it would be no problem ...

Alright, can you give me a hint how to get the infected files? Thanks!

@Marcos: Sent you a private message 🙂

Yeah, Its not the real domain, I changed it :-). Is the malware in a JS file or could it also be PHP?

In Chrome and Opera (not in Firefox) the JS/Spy.Agent.AH malware is being found be Eset. The malware was found in https://example.com/checkout/onepage/, so it does not say in which file. How do I know where the malware is hidden? Any advice? This is how it looks like in the logs: Thanks!