Hi,
I do recommend to contact the host (louhi.fi) as they informed us that the reason was this particular plugin and they approved the site only after the plugin was removed. So they know better. But they said that it was definitely this.
They suspended the site, so I never could run any kind of check myself, they did it. I only removed the plugin. I would also like to know, what they answer, so please, tell, what they say.
The hacked site showed a kind of information that “please fill this questionnaire and you can win a Samsung” and there was a possibility to click ok. And the address was very suspicious (redirected). This text was in Finnish and there were no language mistakes.
