Hi, Have you tried searching your moodle sql database for the page that students are getting redirected?
it looks like it was persistent xss attack and you should find some records related with this .ru site
Security and privacy
My site was hacked. Students get re-directed when accessing blog tag
This discussion has been locked because a year has elapsed since the last post. Please start a new discussion topic.