Jeff -

We have looked at other possibilites.  We are discounting those primarily because all the sites we have found, including ours, that show the symptoms are does, 

a) are inserted into specific DNN tables (the rogue content is inserted into the header & footer sections of an individual modules content settings), typically one that is also set to "show on all pages" like a navigation.

b) have classes inserted that use the term DNN in them (eg: class="Comment dnn" or similar).

While it would be possible for a hacker to affect only DNN sites with a non-dnn-related hack, we don't see it as likely, especially with a hack whose sole purpose, we believe, is promoting his/her SEO by inserting links which for the most part are completely hidden.  

WHy haven't we upgraded? (we are at 4.9.5 now) Good question.  This site, which has over 12k pages, was an Ektron site which we have converted to DNN.  We still have some content in the Ektron system that has not been converted.  We also have written a lot of custom stuff such as Admissions Applications and such.  As a result, our web.config is pretty complex.  We did attempt an upgrade to 5.x last month and it failed miserably, , so we rolled it back...

Anyway, our logic is if we KNEW that the upgrade would resolve the problem, we would commit the time.  Our client is pretty stingy on hours right now, so most of what we are doing right now working on this security issue is on our time (ie, unpaid) and not theirs.