Injection viagra new zealand hack.

A client of mine was running an older version of WordPress. Something malicious injected a link to a viagra site into her header. She doesn’t have a backup, and nothing I do to the header.php file fixes it, so I assume it lies in in multiple .php files. I don’t know how to find the malicious code and was hoping someone here would.

For confidentiality reasons I won’t post a direct link to the site, but this is the code that is showing up. Ever if I remove the div class descriptions string from the header, the link still appears.

[hacked code removed]

I greatly appreciate any help.