And it looks like the most recent version has one more table than is mentioned above.
wp_wfBadLeechers
wp_wfBlocks
wp_wfBlocksAdv
wp_wfConfig
wp_wfCrawlers
wp_wfFileMods
wp_wfHits
wp_wfHoover
wp_wfIssues
wp_wfLeechers
wp_wfLockedOut
wp_wfLocs
wp_wfLogins
wp_wfNet404s
wp_wfReverseCache
wp_wfScanners
wp_wfStatus
wp_wfThrottleLog
wp_wfVulnScanners
If your database looks like mine, ie. same tables and prefix. Run this query in phpmyadmin.
drop table wp_wfBadLeechers, wp_wfBlocks, wp_wfBlocksAdv, wp_wfConfig, wp_wfCrawlers, wp_wfFileMods, wp_wfHits, wp_wfHoover, wp_wfIssues, wp_wfLeechers, wp_wfLockedOut, wp_wfLocs, wp_wfLogins, wp_wfNet404s, wp_wfReverseCache, wp_wfScanners, wp_wfStatus, wp_wfThrottleLog, wp_wfVulnScanners
This is ridiculous. A coworker installed your plugin after they’re blog was hacked. And believe it or not, I’ve spent more time removing what this plugin left behind, than what the hackers did.
And if you wondering… No, the plugin didn’t find a thing. I did though.