ayuda con archivos infectados

Hola como estan acaban de supenderme si hosting y tengo todos mis sitios web en el piso mas de 31 y dicen les envie un ticket y dicen estoy aciendo spam pero esas web no pasan ni de 10 visitas al dia como lo estare asiendo aver si alguien me ayuda este es el ticket que me enviaron utilizo ipage.

Hola,

Estamos en contacto con usted para informarle que hemos detectado un gran volumen de correo que viene de una secuencia de comandos en su cuenta. Este mensaje ha sobrepasado nuestros límites de envío de correo y la cuenta ha sido suspendida. Si esta es tu guión, entonces usted necesita para encontrar un método alternativo para el envío de este correo como contacto constante o el cerebro de correo electrónico. Si esto no es entonces una secuencia de comandos o la forma en que su cuenta ha sido comprometida o está siendo abusado y necesita ser adecuadamente asegurado. Puede encontrar una copia del registro a continuación con la cantidad de correo y la secuencia de comandos que se utiliza en la lista. Si necesita asistencia en la obtención de su sitio o de limpiarlo http://sitelock.com puede ayudarle.

Reported Symptoms:
1207 USER=ipg.marketspinkcom HDIR=/home/users/web/b1778/ipg.marketspinkcom/cctv SCRIPT=/wp-content/uploads/avatars/functions.php

Because of this mail we scanned your account for malware and the results are below. You will need to remove this content and secure your site by upgrading applications, themes, and plugins to the latest versions available and employing human verification on any forms.

erizo/wp-cron.php: SiteLock-PHP-EVAL_REQUEST-ci.UNOFFICIAL FOUND
dream/wp-cron.php: SiteLock-PHP-EVAL_REQUEST-ci.UNOFFICIAL FOUND
dream/wp-content/themes/spasaloon/images/social.png: HG.PHP.Shell.21118.UNOFFICIAL FOUND
bvariedades/wp-cron.php: SiteLock-PHP-EVAL_REQUEST-ci.UNOFFICIAL FOUND
bvariedades/wp-content/plugins/wptouch-pro-3/images/social.png: HG.PHP.Shell.21118.UNOFFICIAL FOUND
ampe/wp-cron.php: SiteLock-PHP-EVAL_REQUEST-ci.UNOFFICIAL FOUND
Sunworld/wp-cron.php: SiteLock-PHP-EVAL_REQUEST-ci.UNOFFICIAL FOUND
cctv/wp-config-sample.php: EIG.PHP.Backdoor.ArbEval-59.UNOFFICIAL FOUND
cctv/wp-cron.php: SiteLock-PHP-EVAL_REQUEST-ci.UNOFFICIAL FOUND
cctv/code.php: HG.PHP.Shell.21310.UNOFFICIAL FOUND
cctv/functions.php: HG.PHP.Shell.21310.UNOFFICIAL FOUND
cctv/wp-includes/class-wp-customize-setting.php: EIG.PHP.Backdoor.ArbEval-59.UNOFFICIAL FOUND
cctv/wp-includes/post-thumbnail-template.php: EIG.PHP.Backdoor.ArbEval-59.UNOFFICIAL FOUND
cctv/wp-includes/css/inc.php: EIG.PHP.Backdoor.ArbEval-59.UNOFFICIAL FOUND
cctv/wp-includes/js/jquery/ui/page.php: EIG.PHP.Backdoor.ArbEval-59.UNOFFICIAL FOUND
cctv/wp-includes/js/plupload/diff.php: EIG.PHP.Backdoor.ArbEval-59.UNOFFICIAL FOUND
cctv/wp-includes/js/tinymce/plugins/compat3x/css/press.php: EIG.PHP.Backdoor.ArbEval-59.UNOFFICIAL FOUND
cctv/wp-includes/js/tinymce/plugins/lists/defines.php: EIG.PHP.Backdoor.ArbEval-59.UNOFFICIAL FOUND
cctv/wp-includes/js/tinymce/skins/wordpress/db.php: EIG.PHP.Backdoor.ArbEval-59.UNOFFICIAL FOUND
cctv/wp-includes/SimplePie/Misc.php: EIG.PHP.Backdoor.ArbEval-59.UNOFFICIAL FOUND
cctv/wp-includes/SimplePie/Net/stats.php: EIG.Hacktool.ArbEval.Obfus-1.UNOFFICIAL FOUND
cctv/wp-includes/SimplePie/Content/Type/include.php: EIG.PHP.Backdoor.ArbEval-59.UNOFFICIAL FOUND
cctv/wp-includes/SimplePie/Content/Type/gallery.php: EIG.PHP.Backdoor.ArbEval-59.UNOFFICIAL FOUND
cctv/wp-includes/SimplePie/Decode/ajax.php: EIG.PHP.Backdoor.ArbEval-59.UNOFFICIAL FOUND
cctv/wp-includes/SimplePie/Decode/gallery.php: EIG.PHP.Backdoor.ArbEval-59.UNOFFICIAL FOUND
cctv/wp-includes/Text/Diff/Renderer.php: EIG.PHP.Backdoor.ArbEval-59.UNOFFICIAL FOUND
cctv/wp-content/ini.php: EIG.PHP.Backdoor.ArbEval-59.UNOFFICIAL FOUND
cctv/wp-content/plugins/LayerSlider/skins/borderlesslight/global.php: EIG.PHP.Backdoor.ArbEval-59.UNOFFICIAL FOUND
cctv/wp-content/plugins/LayerSlider/skins/minimal/object.php: EIG.PHP.Backdoor.ArbEval-59.UNOFFICIAL FOUND
cctv/wp-content/plugins/akossmett/wp-plxml.php: JCDEF.PHP.BACKDOOR.WPTHEMES-01.UNOFFICIAL FOUND
cctv/wp-content/plugins/akossmett/xml-rpcc.php: JCDEF.PHP.BACKDOOR.GENEVAL-04.UNOFFICIAL FOUND
cctv/wp-content/plugins/txxsy/start90.php: EIG.Hacktool.ArbEval.Obfus-1.UNOFFICIAL FOUND
cctv/wp-content/plugins/txxsy/index.php: APEXDEF.WSO_Shell.Unencrypted.1N.UNOFFICIAL FOUND
cctv/wp-content/themes/interior/sidebar-right.php: EIG.PHP.Backdoor.ArbEval-59.UNOFFICIAL FOUND
cctv/wp-content/themes/interior/js/footer.php: EIG.PHP.Backdoor.ArbEval-59.UNOFFICIAL FOUND
cctv/wp-content/themes/interior/img/prettyPhoto/light_square/login.php: EIG.PHP.Backdoor.ArbEval-59.UNOFFICIAL FOUND
cctv/wp-content/themes/interior/css/functions.php: EIG.PHP.Backdoor.ArbEval-59.UNOFFICIAL FOUND
cctv/wp-content/themes/interior/core/page-builder/pb-ajax-handlers.php: EIG.PHP.Backdoor.ArbEval-59.UNOFFICIAL FOUND
cctv/wp-content/themes/interior/core/page-builder/img/functions.php: EIG.PHP.Backdoor.ArbEval-59.UNOFFICIAL FOUND
cctv/wp-content/themes/twentyfourteen/inc/back-compat.php: EIG.PHP.Backdoor.ArbEval-59.UNOFFICIAL FOUND
cctv/wp-content/themes/twentyfourteen/page-templates/contributors.php: EIG.PHP.Backdoor.ArbEval-59.UNOFFICIAL FOUND
cctv/wp-content/themes/twentythirteen/help.php: EIG.PHP.Backdoor.ArbEval-59.UNOFFICIAL FOUND
cctv/wp-content/themes/twentythirteen/genericons/font/options.php: EIG.PHP.Backdoor.ArbEval-59.UNOFFICIAL FOUND
cctv/wp-content/themes/twentythirteen/images/headers/jsconfig.php: HG.PHP.Shell.20884.UNOFFICIAL FOUND
cctv/wp-content/uploads/defines.php: EIG.PHP.Backdoor.ArbEval-59.UNOFFICIAL FOUND
cctv/wp-content/uploads/avatars/functions.php: JCDEF.PHP.Obfus.CreateFunc-6N.UNOFFICIAL FOUND

----------- SCAN SUMMARY -----------
Infected files: 46
Time: 2555.884 sec (42 m 35 s)
Scan ended at - Thu Nov 6 23:54:54 EST 2014

Guy Lasher
Technical Specialist.

tienes un cron por ahí que lo que hace es que te envía correos desde tus sites.