Cleaning a WordPress install, or any site, of such files is generally straightforward. If there's a pattern, do a search of the relevant files and then replace the bad code.
In the case of WordPress, there are a few different sources of bad code (probably others):
- An already infected theme was installed
- Your site's FTP password was guessed and hacked
- WordPress is insecure and allowed a worm to be installed
One thing you can do is install TAC (Theme Authenticity Checker), which will scan for the bad stuff.
See Hardening WordPress for steps to take to make WordPress more secure. But basically when I've seen this happen what I do is back everything up (database and all files), then blow that install away and install a fresh WordPress install, fresh replacement plugins, and a fresh theme (if your theme was custom, get rid of the bad code first!).
Googling for "wordpress infection" should get you other articles with similar advice.