Sgt_Kickaxe - 6:00 am on Feb 17, 2012 (gmt 0)
You're infected, it doesn't matter how or why - shut it down, now.
When that's done secure everything at the same time including all passwords for your host, ftp, server, email, bank website, utility company website etc. Then secure your personal computer too, your server passwords are likely in the config files of your backups - change those too.
There are great guides on Google and on this forum on how to clean up this type of thing but you need to shut everything down and take your site offline right now, before they decide to burn your sites rep to the ground with Google, or worse.