Hello, from what I seen before you installed WP over the top of the infected site was that it was an XSS exploit against a vulnerable plugin. You really should have kept the site up until someone could ID which plugin was exploited so it could be fixed properly.
