This is the same malware I had.

First, clean up the install files as mentioned in the security update at http://www.dnnsoftware.com/community-blog/cid/155362/critical-security-update--please-read so you cannot be hacked again by the same exploit.

Here are the steps I took to get clean:

1. Delete the ASPX files in portals\_default\Smileys
2. Restore the original \default.aspx (unzip the install locally if you do not have another clean site from which to copy)
3. Install the latest Security Analyzer module, log in as host and run it.
4. Review the recent host activity and re-configure anything you did not do
5. Remove the new host account that was added by their rouge install

Scott