I have a similar re-direct as of yesterday, only mine is to
http://www.cadiroig.cat/downalert.html
I have spent hours following instructions,, have re-installed files etc removed directories, I even deleted all files on the server and up loaded last months back up ...... which makes me wonder if it is the database that has been attacked.
I have found this unauthorised visit ......
20749 N/A 04:05, 10th Sep 2013 notice.php modify 91.144.37.46
20748 N/A 04:04, 10th Sep 2013 notice.php update 91.144.37.46
20747 N/A 04:04, 10th Sep 2013 notice.php add 91.144.37.46
........ but even replacing the notice.php with a newly downloaded version doesn't help.
Im kind of hoping that as hundreds of sites have been affected that someone might have found a common fix .....
anybody have any ideas ?