[update]
seemed to have clean the install and no more problems. here are the steps I took:
1. download wordpress and extract l10n.js listed above, and replace it, there is malicious code in it.
2. clean your functions.php file in your themes, some versions of this might affect more than one install or theme, mine happened to just be in active theme. they inject about 100 lines then add some code.
the code:
http://pastebin.com/Qe1Ag47A
thats what you want to delete. also redo your salt tags.
3. make new username/password for wordpress and database.
http://sitecheck.sucuri.net/scanner/ posts that there is no more problems. this was scary as I have about a million hits a month, yikes, hope I didn't do damage to other peoples computers :/
note: this might not be an exhaustive method, there more be more hidden code. my wordpress was updated to most current version and all plugins were updated, so I'm not sure how it happened.
so far no more problems. hope this helps.
You should also check your .htaccess and wp-config.php