One of our customers was also affected by this hack.
A shell process was running on the customer’s server that kept undoing our changes.
www-data 1856 0.0 0.0 293448 3636 ? S Sep05 1:02 php /var/customers/webs/*****/***.*******************.de/lock666.php
It might help you to restart the web server service. This helped us.
p.s. The file lock666.php was not found on the server. I think it was deleted right after starting the process.
good luck,
Norman
