James Huff on "Malware injected with help of wp-cron.php"

To trigger wp-cron, they would have already have to of compromised another PHP file on your server.

Remain calm and carefully follow this guide. When you're done, you may want to implement some (if not all) of the recommended security measures.