I’ve got to say that dvwp’s post is what saved me! I had the Payday Loans hack inserted into my WordPress install on Godaddy hosting. This is a client’s site. Godaddy is NOT my choice. They had it prior to contracting me.
I found the same code at the very top of my theme’s functions.php file. Deleting it completely removed the Payday Loans code insertion into my pages.
In addition to that code I found two .php files in my theme’s cache directory. They were binary. I removed those as well.
It was easy to find the offending cache files as they showed up at the top of the templates list in Appearance > Editor.
I hope this helps some of you trying to fix this issue.
— Bob
