[bitfolk] Help needed with virus infection

Hi All, I need some help. I am out of my depth. All my Wordpress sites have been infected by a virus that acts as follows. Non Wordpress sits are not effected. 1) It permits the home page to partially show. 2) Then a pop-up requests authorization to continue (which I have not clicked). 3) Then in the background the address line changes first to create-space.com and then to adarath.com, before showing an advert for gambling or porn, which depends upon your location and not your language settings. All google hits claim this is a browser virus, but I don't think it is. Every check of my system comes up clean. Almost positive it is on the server. It only appears on the first visit to the site. If I clear cookies and cache, then it reappears. My browser does NOT show this virus for any WP site that is not hosted on my VPS. Unfortunately I am in Thailand, supposedly having a holiday and meeting my in-laws' family, and I have no access to my usual tools or the site backups. Has anyone any ideas how best to proceed? Regards Ian -- Ian Hobson Tel (+351) 910 418 473