Hi! Should you point me exactly to the files infected? I've tested the files, but had not found anything malicious.. Maybe it is this piece of code? <script src="http://tools.spylog.ru/counter_cv.js" id="spylog_code" type="text/javascript" counter="706543" part="" track_links="ext" page_level="1"> And this is just a counter from spylog.ru - let me know, if this really need to be removed I'll remove.