Thanks for your comment. You're right, it would have been much better all round if we'd never had the problem and therefore never ranked for the solution!

I don't think it's theme specific. I've never come across Collage before. I don't think a new theme is a necessary part of preventing a recurrence.

Jim

I found you while Googling "JS: Small-C [Trj" looking for a fix. (Probably not a search term you were trying to rank for…)

Thanks to your guidance I found the offending script in his header.php file and nuked it – problem solved for now.

He's suddenly interested in doing the WP upgrade he's been putting off for too long, but not so interested in changing the theme if he doesn't have to. I doubt that the malicious hack was theme-specific, but I'm curious – did your previous theme happen to be some version of the "Collage" theme?

Assuming your problem is the same as ours you need to manually edit the header.php file for your WordPress theme.

If that doesn't apply to you, you need to find which .php file contains the trojan. It will start with code something like:

<script language=javascript>document.write(unescape

Just remove everything including and between <script and </script>

That did the trick for us. Hope it's some help to you!