I'm trying to fix a site which has been injected with external spam. After inspection I found out that the external content (so far just html advertising different kinds of drugs, no scripts) was in the static pages created by w3 total cache.
How can I find out what part is responsible for this? The obvious answer would be the w3 total cache plugin itself, but the pgcache is actually writeable by any part of wordpress so it might be any other plugin or even the WP core.
I have searched the web for this problem but found nothing directly relevant.
Of course wordpress is updated to the latest version available (3.0.2) as is every installed plugin. It does not depend on the theme as it happened with two different ones.