Web Server Has Been Attacked

Server info:
Windows 2003 box
Dedicated server currently hosted at the planet.

Problem:

It would appear there has been a security breach into the server recently. This morning we cleared off a Trojan, and also a new user that had been created on the server.

All of our websites we host (around 200) had been affected. Almost every file had new javascript or links to an .swf, they load in iframes and are very malicious, actually giving any vistor to the site a virus.

I tracked down the embed code that I found in most files appended to the end of each file.

Below shows up in most .asp, .cfm, .html files (no spaces, just can't paste a url in here yet)...

<scRipT s rc=[url]
<scRipT sr c=[url]
Below shows up any any .js file (no spaces, just can't paste a url in here yet)...

document.writeln ("<script sr c=[url]
document.writeln ("<script sr c=[url]

So I got a script that opens up every file looking for this code and stripping it out.

Seemed to work at first, but now all the sites have been rewritten again..... and again.

So obviously something is overwriting this.