I'm working on a client's site and I noticed that posts have a hidden
<div> filled to SPAM links to dick pills, etc. Hoping to get lucky, I searched for some of the keywords in the database tables, but found no matches. I also searched the code in all the files, and also found no matches.
I know that Wordpress hacks can be very tricky to remove, and they go to great lengths to make them hard to find. But perhaps there are some "usual suspects" that I could check, or maybe some tell-tale signs I could look for.
I'm not asking for anyone to solve this specific hack. I'm just looking for advice on where (in general) to look.
In case it's useful, here's the unauthorized
<div> which is injected right before the close of the first