Redirecting the site to WordPress, and closing the hole

Another case with WordPress.User when switching to the site redirect to the site with phishing.When reviewing the site, no harm was detected.It was broken by specialized software several times all directories.All security settings wereined in a strict order.But in the end, a revers of all files on the site was carried out and here is the harm and showed itself.
The line that redirected the user was found in the "WordPress icons" file.And this file was caused, as it was later revealed by the mdxsc.php file, which belongs to the photo comparison system, which was on the host(Shared hosting),will damage through the host passed into the site of one of the customers...As the company's value site,and was purchased an antivirus protection,this in the end the host was provided all the evidence of the incident and as a result received compensation.
The wordpress redirect
The redirect
The broken
Protecting WordPress