My server's been hacked EMERGENCY
A friend is experiencing a random redirect to an RU domain for two of her websites, along with a malicious cookie attack, as per a Norton pop-up everytime I load a page on her site.
I checked out her WordPress installation and I saw a suspicious plugin which I deleted, and I also cleaned up the .htaccess files which were clearly compromised with these Russian redirects.
However, even after ensuring all .htaccess files were clean, the site is still redirecting.
Any idea what I can do to diagnose, and rid the server of these issues, short of a fresh WordPress installation?