Most of the sites were infected recently with malware (most of the php’s injected with malware code).
One of the sites happens to be a forum which uses vBulletin. Even this was infected - a fresh install of vBulletin software fixed the issue, but only temporarily.
After a day or 2, again all the files were infected and couple of users posted snapshot of Mint.js infected as well.
So in attempt no 3, I cleared up vbulletin and mint and did a fresh install. Again after couple of days, files ended up being injected with malware !!
In attempt 4, I removed mint (did not reinstall) and just installed vbulletin. And now there seems to be no issue with malware!
Is it possible that malware is in mint DB? If yes, is there any way to scan/clear without losing the analytics data. Please suggest
Note: For site scan, I used http://sucuri.net