I have stepped on your plugin and it seems it works nice. I am having real trouble with a friends WP site. He is in his high season Art school enrollments and the website got some malware which made the website not showing menus, admin pages etc.
I ran a complete scan with the latest definitions and it found around 100 Known Threats and around 40 Potential. I cleaned the Known threats and after some hours the Known THreats were even more. This was done around 4 times. I now went through 1 by 1 the Potential threats and i found some php file with filenames like 34252435.php in different places.
Before that step i also installed WP Security to ensure i will not have the same issue, but i still do. Can i have any more help?