shotok on "Hack, malware or plugin corruption? Menu bar has new bad link?"

Thank you Rachelle. I just had this same problem. The malware code was indeed in functions.php as you suggested.

Initially couldn't find that file. I logged into my hosting account control panel>wp-content>themesyourtheme>functions.php

Thanks again