Well it actually removed it from all the sites. 338 Threats. I did a victory dance and a sigh of relief only to see today all the sites have been breached again. Depression setting back in.
Some of the sites my guy installed securi, Not sure if it is conflicting. The sites I installed yours, I removed the securi. But I do see yours is scanning securi as well 
I can see all my sites updated at like 3:45 am. but when you ope the folder you do not see anything, accept permissions opened on the config file to 0600. But it does not show it was edited, but I am sure that if I looked at the config file it has malware.
Right now I cannot log into my main site again. I can fix the config file from a file I know that is not corrupt and scan it again. I showed it isolated the malware, so I am confused. Tell me what I need to send you, or I can set you up to log into the main wordpress. What ever is easier.
