Remove malitious code from an oscommerce site that has an SQL injection and php iframe issues

Hi there, We took over the hosting of a clients site, and found since we moved it to our servers that it has malitous code that now works because the path changes since the host move. My coder needs to go to sleep now so i want to put on here so it can be cleaned quicker. Site URL is given in another part of this brief. ## Deliverables the URL is [login to view URL]