Nevermind. I found a vulnerable version of Revslider on the site. I thought we'd updated it on all sites, but somehow this one didn't get updated. I think it's clean now. Doing some checking to be sure. Also checking other sites on the same server. Fortunately I think my host has things so locked down and separated between "apps" that there's not much chance this site was used to infect others. Going to check anyway, to be sure.
↧