Same problem with brand new site. Within a few days the site was hacked again.
This would suggest an external JavaScript which is called was changed.
Here’s what I see as possibles:
ajax.googleapis.com/ajax/libs/swfobject/2.2/swfobject.js
lite.piclens.com/current/piclens_optimized.js
Any thoughts?
Jamees