Thanks Roger,
First, if both sucuri and my plugin are coming up with no known threats then I would suspect this is a new type of infection. I would love to get into your WP Admin and see what I can find. If I can look at the infected files I can add them to my definition update so they can be identified and removed automatically.
It was a great idea to change all those passwords but if the hacker is still able to plant files on your server then they are probably using a backdoor or a server vulnerability that has not been found yet. Maybe I can find this too and stop the reinfection of your site.
You can reply directly to my email to send login credentials (don’t post them on the forum 
) and I’ll let you know what I find.
Aloha, Eli
