well it was an easy thing to clear out... but not for me :) I am just sharing it here in case anyone will have the same issue, it took me several days to understand where things gone wrong so this is my solution -> the malware code was added not in a module or database but was added straight to default.aspx file, it was pretty easy to see where the code is comparing clean default.aspx to the file from infected site. so I have cleaned the infected part out and saved the file. after that I requested google to revise my site again through google webmasters tools, and in 1 day the red warning from google stopped showing up. I have also changed all passwords just in case. :) and thank to all those who was offering their help even so close to new year's day :)