One of my sites was infected with malware (hosted on another domain, which is not mine) and after a search I found that the code was hiding in the javascript file that belongs to the FLV Embed plugin.
If you’re using FLV Embed, I would keep an eye on it or just delete the plugin.
