Sure avast! is right, I guess we can all agree on that.
Also read here: http://blog.sucuri.net/2011/09/mass-spam-infection-from-wplinksforwork-com-50k-wordpress-sites-hacked.html