About 2 weeks ago I got an e-mail from a customer of mine if I could help him with his magento site (1.9.1). With my big mouth I said: sure! I can help you. I have no experience with Magento and I only have build websites in Wordpress, the hostingcompany said that the site was compromised and hacked. I have been trying to cleanup all the bad stuff with a FTP account. However I don't know where to start, please help me.
Firstly I'd put the site into maintenance mode until you know what has been compromised. If it's payments you cannot take a chance.
Assume they have root access to your server and update the logins and passwords.
Then, try to get the most recent copy of the site before it was knowingly compromised. If you can't get that, then get a fresh install of Magento 1.9.1 and do a diff of the two. It'll take a while but it's the only real way of knowing what's updated (assuming they don't have Git or a CI server to redeploy to).
Get a database as well and check if any new administrator accounts have been set up.
Check the payment configuration options - we have seen before where the PayPal account was changed.
Check for credit card hacking with 'images' - https://blog.sucuri.net/2015/06/magento-platform-targeted-by-credit-card-scrapers.html This has been widely used.
Check the installed extensions to see if they have installed a file browser module that the client doesn't know about.
On top of everything @Paul said, make sure that you check out the 'Miscellaneous Scripts' setting under configuration > design in the Magento backend. Both the HTML footer and head are often used for placing malicious code.
Try to scan all the files on the server with a malware/virus scanner and clean infected files. We're using Clamscan for this: https://linux.die.net/man/1/clamscan
After cleaning the site, make sure that the site is fully patched and protected (magereport.com).