I would advise anyone affected by this attack to activate the SQL profiler (or equivalent) and set it to record only EXEC commands. If your website then becomes infected again you can quickly scroll through the profiler output and find the "suspicious" command where the injection has entered. This should also give you a hint of the exact page that had the vulnerability.
I cleaned up a site this week where the profiler had recorded:
SELECT TOP 100 People.Countries, States.Titles, Houses.Types FROM People, States, Houses Where People.Titles LIKE '%agent;DECLARE @S NVARCHAR(4000);SET etc......
So I could quickly locate the page which had the SELECT TOP 100 statement.
That is where I added the quick fix:
<%
some code here....
%>
<!--#include file="validator.asp"-->
<%
rs.Open sql
%>
With the validator file containing:
<%
if instr(lcase(sql),";--")>0 then
response.redirect("index.asp")
end if
if instr(lcase(sql),"nvarchar")>0 then
response.redirect("index.asp")
end if
%>
Cheers and good luck,
Nicolai Hertz
software programmer