There is a fix but it’s different for every install. These hackers got sneaky. If you have TimThumb installed in your theme, you might get this virus.

Read this:

http://wordpress.org/support/topic/iframe-hack-3

I have the same issue, sucuri indicates that my jquey file and another file are infected also when I downloaded my backups to windows my antivirus detected infections in 2 PHP files.

Malware found on javascript file:
http://****.com/wp-includes/js/jquery/jquery.js?ver=1.6.1

Malware found on javascript file:
http://*******.com/wp-includes/js/l10n.js?ver=20101110

Backdoor:PHP/Merview.A
\wp-admin\common.php->(SCRIPT0000)
\wp-admin\js\config.php->(SCRIPT0000)

Ipstenu said:

Then you’re not cleaning it up right.

Best way at this point would be to do this:
1) backup EVERYTHING to your PC. Files and DB.

2) DELETE the files on your server. Yeah. Don’t worry, your posts are on your database, we’re leaving that alone.

3) Change your passwords fro SSH/FTP and SQL

4) On your PC, review the following files:
.htaccess
wp-config.php

They look okay? Good. Copy them back up to your server (remember to edit your wp-config.php with your new SQL password).

5) Get FRESH and CLEAN downloads of WordPress, all your themes and plugins

6) As soon as you get in, change your passwords.

and also change your ftp passwords. if they get into the server itself, it does not matter how secure WP is. they can get to your files like you can.

Also moving this out of the multisite forum.

I agree with Jorge, the best way to ensure your site is clean is to back everything up and start fresh and load everything back one at a time while testing to make sure what you are putting back works properly.

@magzparmenter

You download EVERYTHING (the new WP install and all your plugins) from WordPress.org and if you’re using premium themes, make sure they’re not running the TimThumb image resizing library.

IF YOU DO RUN TimThumb, make sure your server (localhost) is the only domain that can write into your directories. You can do that by opening up /timthumb.php or /thumb.php in your theme and configuring not to allow remote access.

EDIT: I have never used TimThumb for anything! WordPress has built in features and support to resize images and serve up image thumbnails on the fly. To me, it’s a lot easier to use the_post_thumbnail function. That’s just me though.

OK, so sucuri now says my site is clean…but half of my images aren’t showing up!

I stupidly deleted TimThumb and now I can’t get it back and not sure what to do…although, I have an Elegant Theme and they said they don’t use TimThumb anymore because of its known vulnerabilities (no kidding!!)

Grrr….grrrr…..grrr….