I had the same thing happen to me this morning. I contacted my host and had my passwords reset. The compromised file (at least the one I’ve found so far) was the theme’s header file. I deleted the theme’s entire directory and re-uploaded a fresh copy.
I have not yet found any other compromised files, but I also don’t have the expertise to know what the hell I’m looking for either.
The thing that concerns me is not knowing how they got access in the first place. I’m kind of hoping it was just a cracked password, but my fear is that there’s some backdoor hanging open that I can’t find because I don’t know what to look for.
Also, something weird:
Despite deleting the entire directory for the theme, when I uploaded and activated the fresh copy, it had retained all of the optional tweaks I had made (e.g., blockquote formatting, etc.).
How is this possible? Are those things saved elsewhere (outside of the theme’s directory)? If so, how is it that you can activate another theme, and those settings are (obviously) all different, appropriate to the new theme?
I ask because I’m just afraid I may have missed deleting something that I should have deleted when I was deleting the theme.
