FIXED - Malicious code keeps disabling payment extensions

Ive got a customers site which has been hacked and infiltrated with the fake authorize.net payment option which looks to scam credit card details on checkout.
What happens is the usual payment gateways, ie paypal and barclays get automatically disabled and then a fake form for "Authorize.net" appears asking for customer credit card details, this kind of attack is known on this forum if you do some searching.

Now I believe we've fixed the issue of the credit card form appearing and replaced the neccessary files, but any payment gateways still get automatically disabled as soon as the checkout page is refreshed, ie after the address is added, the checkout page warns that "No payment options are available" and a check back in the admin shows all payment options disabled again.

Currently im waiting for Qphoria to get back to me, but i appreciate hes a busy man so wanted to see if anyone else had some thoughts or help on this, currently my clients website has been off for 3 days now and not taking orders so time is critical.

Thanks in advance

Drop me a tell at support@thekrotek.com. I'll see, what I can do.

I think ive fixed it! I simply upgraded the Journal version to the latest version and that seems to have done it, ive no idea why but there we go. Obviously I had some help for Qphoria who assisted in replacing infected files and added some security on the htaccess files.

Journal discovered/fixed a Security Problem some months ago, it's rather surprising,
that Journal Users seemengly have not been informed about the urgent need to upgrade,
in der first place. Just to mention this !
Ernie