The vulnerability, which I wrote in this post, is already fixed in WP 3.1.3. So these attackers used another hole in your WordPress or in plugin for WP or in other webapps or in web server.

If they attacked you via brute forcing ssh and they picked up password for root, then you need to change this password also, not only password for your WP installation. In any case, if you changed all passwords, but they still putting phishing content at your site, then it’s quite possible that they put backdoor into site (in WP or in other webapps).

Concerning backdoor you can read in my article Placing shells (backdoors) at web sites. So you need to find backdoor and delete it (or you can delete all files in your WP folder and reinstall WP and all plugins for it, to make “clean” installation).

http://let.de/index.php/code-execution-vulnerability-in-wordpress/

what todo ?