same problem
cat /usr/local/psa/version
10.3.1 Debian 6.0 1013110726.09
proftpd 1.3.3e
last attack in 2013-05-13 on many html and php pages with injiection of iframe code with src from 'ishigo.systes.net'
source ip (found in proftp logs): 188.190.124.120
Then I changed all ftp passwords...