You might want to read this post about how the malware works and why you shouldn’t save passwords in FTP clients.

We had almost every index.html, index.php and several other files infected with these iframes on our server.

could you explain how could this spyware injure our computer? Where should(n’t) we click to (avoid) the injuries?

Thanks!

Here’s the script. I hope it’s useful for other people.
(make sure to backup your site befor using this one)

<?php
$path = ".";//define the path as relative

// filenames infected in Joomla sites:
list_dir($dir_handle,$path,'index.php');
list_dir($dir_handle,$path,'index2.php');
list_dir($dir_handle,$path,'index3.php');
list_dir($dir_handle,$path,'mainbody.php');
list_dir($dir_handle,$path,'index.html');

function list_dir($dir_handle,$path,$filename)
{
$dir_handle = @opendir($path) or die("unable to open $path");
while (false !== ($file = readdir($dir_handle))) {
$dir =$path.'/'.$file;
if(is_dir($dir) && $file != '.' && $file !='..' )
{
$handle = @opendir($dir) or die("unable to open file $file");
list_dir($handle, $dir, $filename);
}
elseif($file != '.' && $file !='..')
{
if(strcmp("$file", "$filename")==0)
{
$handle = file_get_contents($dir);
if ($handle)
{
preg_match('/]*>(.*)/s’, $handle, $iframe); // find iframes
$hacked = str_replace(“<", ">", (str_replace("<", "<", $iframe[0]))); // sanitize HTML for viewing
if ($hacked)
{
echo "\n$dir $hacked”;
$cleaned = preg_replace(“#$iframe[0]#”, ”, $handle);
$thisfile = fopen($dir, w) or die(“unable to open file $file”);
fwrite($thisfile, $cleaned);
fclose($thisfile);
echo ‘(cleaned)‘;
}
}
}
}
else {
//do nothing
}
}
closedir($dir_handle);
}
?>