PartyOn – thank you! I found one of the files hidden in wp-feeds.php in my theme cache. Started with eval(gzinflate(base64_decode and just went on and on. I deleted it. Now I just searched on the specific php 9cb702aa084691e66c789c1e98d6233a.php that was showing up in my blog editor and found a bunch of TimThumb files in my ftp, but not sure if I am supposed to delete those too? I am a newbie at this! Thanks for the help!!