wslade

I hate to be the one always giving you bad news but that plugin likely did not get installed with malware. I believe you when you say the plugin had malware but it probably became infected from some other source in your site. You reloaded all new plugins, right?

Your site was damaged pretty badly and it is often difficult to find all the malware. If you haven’t noticed from the link attached to my name, I do this for a living.

If I were you, I would take your host up on their offer. Especially if terminate and recreate means deleting and restoring from a known good backup. If they do a restore, your plugin configurations and everything will still be there.

All those unused subdirectories will be there as well as a possibly unsafe theme. So there will be considerably more work to be done after the host finishes the restore before you can feel safe with your site.

You mentioned that this seems drastic but I consider all the work you have already put into cleaning the site to be pretty drastic and it’s probably not fixed yet.

If you really do not want to go with the host’s restore, I can help you scan for the rest of your malware. But here is why scanning and looking is so difficult. The average WordPress site has about 4000 files. Each file might average a 1000 lines of code. So the average WordPress site might have 4 million lines of code. It only takes one line of code for a hacker to have a backdoor into your site.

If you have questions, just post back here.

I see you have a error notice. Just open up your /wp-config.php file and add the following line:

define (‘WPLANG’, ”);

This will cause a default to English. You will want to add your chosen language.

What great news! Were you able to auto update at 4.1?

It looks like you may still have some malware. I tried it with Internet Explorer. After it opened I clicked the logo and I got a popup that I couln’t close.

Download any subdirectories you are not using or hasn’t been kept up to date to a file on your workstation then delete the files you downloaded from the server. Check to make sure your site is still working (at least as well as it is now).

A stock install only has three directories: wp-contents, wp-includes and wp-admin. I’m not saying you can’t have others but anything you leave should contain new up to date files.

Download all the themes on the site to your workstation and delete the themes on the server. If you want to use Zero Gravity load a clean new copy to the server. Load a clean new version of Twenty Fifteen to use as a default.

Check again to make sure your site is still working and then replace all the plugins. You can delete them one at a time and load new and check the site if you like. If you delete and reload the plugins using FTP all the options should stay as they were. If you delete and reload the plugins from the dashboard, you will probably loose the plugin options you configured.

If you deleted everything but wp-content and wp-config.php earlier and installed new WordPress files then you should have a nice clean up to date site. It would be a good idea to run a new Wordfence scan to verify.

I’m glad you found a file with malware. A hack seldom only affects one file. Adding a good security plugin is good. But there is no better solution than restoring from a known good backup.

What I see has not changed from the first time I looked at it and it is not exactly like either of your last two images. Here is what I see: http://tinypic.com/view.php?pic=291g9dv&s=8#.VY9E6_lVgSU