wordpress infection

Hi, I found malware today on my sites (wp vdc). They are all in the same DirectAdmin account but run as separate sites. Luckily I have dealt with this malware before, so I knew what code to remove and what files to clean it up. The strange thing is this: - All sites run paid themeforest themes...