Let me explain the situation:
I had a XOOPS site and I migrate to a new hosting and added a domain. With all the movement of files up and files down and changes of config files I forgot the config file of phpads module accessible with the database name, password... everything.

After that I realised that all my index.html and index.php had an iframe (Code injection?).
I cleaned them all, changed my password, changed the attributes of the mainfile.php and I had no problem for a whole month until yesterday... the iframe didn't point to the same place, but seems to be the same type of injection.

All kind of help, or advice or whatever is welcome!

Thanks!