I'm deleting the whole site right now and I'm starting with a completely fresh install without malware. I'm hoping that my account can be restored permanently instead of 24hrs, since the malware will be gone soon.
Ok, I'll make backups and see what's wrong. Can't imagine malware, unless one of my users uploaded something strange Can I please have the filenames that are supposed to be malware?