Wordpress site Infection : save your site

Today I witness something , that I never expected to happen. At office I was having chat with my friend Gopal. Gopal had subscribed to my wordpres site "burnedpages.com" through feeds. Suddenly his computer blocks an infection from my site (Thanks to Avast, the best in business). I was kinda surprised.
First I thought it was a false alarm but when i reached home, I couldn't access to my site. My own avast was blocking all the infection. So I figured something had wrong. It was my first time hosting a site, and I didn't wanted Google to show my site as unsecured.
I was using wordpress 3.0.1 with "erudite" theme. no other plugins.
I don't want google or other search engine to ban my site from search results, So here are some (desperate) steps that I took:-

• Backup of Data:- I used my website admin tools to get access to my wordpress database and then exported all the data to my computer. after all its your work and it shouldn't be wasted. My site provides an easy way to export the database using "PhpMyadmin". phpmyadmin has an export option that can be use to export your data to a text file. This backup is very usualful  if you need to change wordpress database name. In most cases it wouldn't be necessary though.
• Change FTP password : I guess hackers some how accessed my ftp password, or used sql-injection techniques to transfer the infected code to my index.php file. Any ways I changed my ftp password to a secure and hard to crack one.
• Deleted WordPress:- Then I deleted all word press files. (Yeah its better to delete it and then install a fresh one, rather then cure the infected file yourself. You can remove  'Extra Melicious code' from your webpages,but i guess wiping is better ;)   )
• Note for users:- Created a html page in my site saying that my site is undergoing maintenance.It is great for your traffic, otherwise people may go like "WTH, this site was working yesterday".
• Upload the original installation: If you have original installation of wordpress in your computer , you can upload them back and get your site to its original state easily.
• Access modification  : Change file permissions on your site so only you can write them.

And my sites was up and running in 10 mins. Next time I will be more careful.

What I have learned :- Don't use Wordpress own theme installation module . Why? it uses FTP and its better if you do it from your FTP client. Choose a hard password to crack for your wordpress installations. Its better that your site remains under maintenace mode rather then spreading infection. I hope it helps those wordpress sites that have such infection. Wordpress is great blogging tool and such incidents shouldn't put a question mark on it. Webmaster can be and must be a little careful next time.