i use fast.cgi and suEXEC. I got an mail from cert, that the server is infected and I see that there is a problem on our network monitoring system.
On the server ther are a view websites. so i do not exactly know which one is infected.
The Joomla installation is from a customer.