Server redirect on hacked website...

[polonus]

See the detection missed: https://www.virustotal.com/en/url/f478b43b43a34f1a5504ce45db60c567e6a67fe76b2a514be50f5e56f39e5f9b/analysis/1427479942/Detected: http://sitecheck.sucuri.net/results/1kadaysecrets.com

ISSUE DETECTED   DEFINITION   INFECTED URL
Website Malware   malware-entry-mwht291?v18   htxp://1kadaysecrets.com/404testpage4525d2fdc
Website Malware   malware-entry-mwht291?v18   htxp://1kadaysecrets.com/404javascript.js
Website Malware   malware-entry-mwht291?v18   htxp://1kadaysecrets.com/?page_id=82
Website Malware   malware-entry-mwht291?v18   htxp://1kadaysecrets.com/?page_id=105
Website Malware   malware-entry-mwht291?v18   htxp://1kadaysecrets.com
Known javascript malware. Details: http://sucuri.net/malware/malware-entry-mwht291?v18
Location: http://redinter.ru/in.cgi?8
Web application version:
WordPress version: WordPress
Wordpress version from source: 3.9.3
Wordpress Version 3.9.x based on: htxp://1kadaysecrets.com/wp-admin/js/common.js
WordPress theme: htxp://1kadaysecrets.com/wp-content/themes/twentyten/
Wordpress internal path: /home/kadaysec/public_html/wp-content/themes/twentyten/index.php
WordPress version outdated: Upgrade required.
Outdated WordPress Found: WordPress Under 4.0

Server redirect status - red - Code: 301,  htxp://redinter.ru/in.cgi?8  * a hidden file or code in another file that is rewriting this to Redirect to external server!
Quttera detects:
index
Severity:   Suspicious
Reason:   Detected suspicious redirection to external web resources at HTTP level.
Details:   Detected HTTP redirection to htxp://redinter.ru/in.cgi?8.
File size[byte]:   0
File type:   Unknown
Page/File MD5:   00000000000000000000000000000000
Scan duration[sec]:   

Potentially suspicious: /wp-content/plugins/webcaster-cloud-pro/js/jquery.hashchange.min.js?ver=3.9.3
Severity:   Potentially Suspicious
Reason:   Suspicious JavaScript code injection.
Details:   Procedure: + has been called with a string containing hidden JavaScript code <script>document.domain=""</script>.
Threat dump: view:   http://www.webpagescreenshot.info/img/5515a0b75c8f60-63203853
Threat dump MD5:   E0D0AF8E6A71A5B9CC9026F3F82F4871
File size[byte]:   1526
File type:   ASCII
Page/File MD5:   757898A5793D29189E52CA6EE8FCE808
Scan duration[sec]:   0.146000

polonus