Get Off Those Maliciously Loaded Scripts!
Download this free Anti-Malware Plugin for WordPress.

I fixed it! the redirect turned out to be in the .htaccess file in your user’s root directory (up one level from your web’s root directory). I expanded the search range of my plugin to look outside the public_html directory and, bang!, it wound it right away.

Now that the malicious redirect is out of the way you still are getting 404 errors on all pages except the home page. This is because you are using a permalink structure that requires the following code in the .htaccess file in the public_html directory but it looks like “Better WP Security” has locked down that file (maybe a little too tight). You’ll need to use FTP to put this code back into that file: