Despite all my work to harden my website, someone has managed to hack it.
When loading the homepage in IE8, the page appears to load normally. Then, the status bar briefly displays a request to a domain that is just a jumble of letters followed by .com. It opens a Windows Media Player window, and as that opens the IE screen goes red with a "this site has been reported as unsafe" warning on it.
In Chrome, the site loads normally, and I get a warning that the Java plugin needs my permission to run. I did not grant permission.
In Firefox, everything looks normal, but in my NoScript menu there is an item labeled "http://undefined", which I of course blocked.
The good news is that I was able to capture a screen movie of the problem in IE and was able to note the malware domain for research.
When I first noted the problem I started Wireshark and have logged everything in and out of my PC since. This provided me with multiple DNS requests with domain names linked to the attack. I have also downloaded the server logs. Our entire site has been moved into a holding directory and an 'unavailable' message has been put at the root of our domain. I have changed our server login password.
Now I'm not quite sure what to do next. I am a creator, not a security expert. My current position does not have an IT or Information Security department to get assistance from, so I am seeking help from anyone who may recognize the symptoms of this attack.
UPDATE: I found malicious files in my server identical to what was described at http://stackoverflow.com/questions/6686354/virus-problem-google-verify-php-and-ftp-passwords
Update Oct. 26: After reviewing log files, I found that the hack was done via FTP. Evidently my login was stolen somehow.