I did a search on Google for a keyword I knew my site ranked well, it was still there, but when I clicked it, I got a warning saying that the site was blocked due to risky/malware content. I freaked out. Knowing that I was risking infection, I still wanted to see where my site was redirecting to. So I clicked “Continue Anyway”, and it redirected me to a domain ending in .ru (Russian, can’t remember the exact domain though, had enough trouble getting rid of it). Luckily enough, my firewall blocked the virus from downloading.

So after I had made sure that my site was infected. I had to figure out how it happened, and then how I could fix it. A serch for “wordpress hacked redirect” led me to some articles that talked about posible ways it could have happened. One of them was by modification of the .htaccess file. I connected to my host, opened the .htaccess file, and at first sight, it seemed OK, but there were scroll bars around it, so i scrolled down and to my surprise, there were lines of code that commanded traffic coming from search engines, to be redirected to the malware site. I deleted the extra lines of code, and tried to save, but it didn’t work. The hacker had chmod-ed it to 444 instead of 644. So i had to log into the cPaneland delete it, replacing the .htaccess file with a clean one. And woala, it was fixed.

10 minutes after, I checked again and the .htaccess file was hacked again. And this time, all other sites on that hosting account were hacked as well. I slowly started panicking, because I kept replacing the infected .htaccess files for every site, but after some minutes, the hacked version was there again. So I came to the conclusion that it was a script placed inside my hosting account.

Doing some research, I came across many people who were having the same issue. And ti seemed to be the consensus that an outdated plugin was the hole where the hacker got access. It was the timthumb.php, or thumb.php plugin. I did a search for thumb.php, and about 11 cases came up. I went on and updated them with the new code, which can be found here. Make sure you do a backup though, even with the infected files, in case something goes wrong, you can always go back to the previous state.

After I had updated the plugins, it was time to replace the infected .htaccess files once again. I did that, and this time more than one hour passed and nothing happened. So I thought I had finally fixed it, only to wake up the next morning and find out that they were infected again. This time I thought it must have been through another backdoor that the hacker must have left. So I started looking for suspicious files.

Some sites said that for this kind of attack, the hacker had placed backdoors named _wp_cache.php, _cache.php, sm3.php, and even wp.php. Usually placed in the wp-content/uploads folder, or even in the theme directory. I couldn’t find any such files. I could however find something that looked suspicious to me. In the uploads folder, among other folders named after the years when the uploads were made, there was a folder named js_cache. When I opened it, there were two files with long names, one .php and one .tmp. I knew I never had uploaded such stuff, only images, so I immediately deleted them. And it has been a full 24 hours so far and no more hacked .htaccess files. I think I finally got it to work, and I hope there won’t be any need for another fix. I need to state that I changed all my FTP passwords, hosting login, WordPress admin passwords, and database passwords.

I hope this helps someone out there struggling with the same issue.

Here are some other sources though, in case your situation doesn’t match mine:

http://codex.wordpress.org/FAQ_My_site_was_hacked
http://wordpress.org/support/topic/268083#post-1065779
http://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/
http://ottopress.com/2009/hacked-wordpress-backdoors/