Help! Recovering from iframe malware attack on index.php

Hi folks,

I'm in the midst of fending off a malware attack that adds a hidden iframe to the index.php file. (It's likely the result of compromised FTP login credentials, which is what the malware sniffs out on infected clients.) More generally, this malware is known to make the malicious code insertion into any index and default pages it can find on the Web server.

The "good" thing, if that's possible with malware, is that the code injection simply causes all Drupal-related pages to error out with everyone's favorite error:

"Parse error: syntax error, unexpected '<' in /f1/content/[site]/public/index.php on line 38"

On one of the two Drupal sites I'm fixing, deleting the iframe insertion (which was below the footer code in index.php) does the trick. But on a second Drupal site, fixing the index.php page hasn't solved the problem. I'm still getting the same syntax error, and I don't believe it's a caching issue. I looked through my entire installation for any changed files but couldn't find any, though it's possible I've missed something somewhre.

Any advice would be greatly appreciated about where else to look in my Drupal installation for index files or others that could be creating the syntax error.

My thanks for your help,
ITG3000