order cipro generique cialis

a friend has been hacked and this link to a url appears on his wwbsite on a couple of pages.

i’ve updated his .htacess file, rest all passwords, deleted folders and some files, cleared comments, removed all plugins but for some reason this keeps on reappearing. i’ve checked style.css, headers and footer.php but cant seem to find anything..

anyone have any suggestions?