Per Chris, the exploit was in the DB, so just finding and replacing the file in the WP folder was not good enough, the DB needed to be cleaned as well. So here’s a how to:

For folks who regularly back up their sites, it would be much easier to do the fix as opposed to those who do no back up their site (another reason to use wp-db-backup plugin). Nevertheless there are ways to get the DB cleaned out. We will discuss both, but before we do that, here’s a step-by-step to find and remove the PHP file that is causing the havoc.