A bit difficult to tell in detail the remedy for this one without actually looking the website. However, a couple of things you can do for now:
- If you have an instance of website running on your local machine, can you scan the website code with Kaspersky? It will tell you the exact file location which is being regarded as malware.
- Can you search for the following terms in your website files: 'grelos_v' & 'eval'
The above terms mentioned in the second point can return multiple results (especially eval). So, you would have to go through each file and look for any code that doesn't look legit. Usually, hackers append base64 encoded code in the starting or the end of legit files. You need to find and remove that.
Hope that gives you some start.
-Luce
