[Preemo]

Oh dude, that is balls for you.

Usually you will get this type of attack through plugins and themes. The script could be embedded down to the database level.

How you get rid of them is fairly tough. You're going to have to restore from a backup and secure your blog more thoroughly. Which means changing the directory of wp-config. You can search Google for all the security tips. Other then that, without actually wasting an entire day scouring for malicious code, that was the best method I found.