Get Off Those Maliciously Loaded Scripts!
Download this free Anti-Malware Plugin for WordPress.

Thanks for posting the contents of those files that contained new threats. I added the one from your first post to my definition updates yesterday so that it came be automatically removed with my plugin and I am working on this last one now so that it too can be found and automatically fixed.

Rogue admin users are hard to detect automatically because there is no universal way to tell the difference between those whom you would have added as an admin user on purpose and those whom you did not want to be added. But my plugin should have been able to find and fix the malicious code that added that user and also the code that was concealing it. If that code was also not detected and you can find it in a newly added plugin file or a theme file like the functions.php file then please also send me that code so that I can update those definitions as well.

Malicious code is always changing and evolving to avoid detection. That’s why I am always releasing new definition update to keep up with the new threat variations. We need to see any new variants to that they can be identified and defined for future scans. So far, what you are doing combat this threat is good but you will need to add one critical step to your cleanup process in order to track down the source of the infection to find and fix the root cause. For every infected file you find you will need to stat the file as it is on the server before you delete it or make any changes to the file. You need to get the exact times that the file was last modified or changed before your own changes to that file overwrite the timestamps of the malicious changes. Then you can use those exact server timestamps and cross-reference the activity in your access_log files to figure out what exploit was used to plant those files or to inject that malicious code into those files. Follow that trail back as far as you can and you should be able to find the first breach and patch that exploit to prevent further attacks.

Please let me know if you get stuck and need any further assistance, and please also send me any new threat you find so that my plugin can help you remove them, and any other copies of those threats, from your server.

I see your homepage in your sitemap and there is nothing in your robots.txt file to prevent indexing that page, so I’m would guess that Google just has not refreshed their own cached index of that URL yet. I also still see one listing in the Google search results for your site that shows the Chinese characters you were talking about, but that links to a 404 on your site, so it should also fall out of the search index in time (whenever Google gets around to rechecking the cache they have of that page and see that it is now a 404).
It looks to me like you have done everything right and the site look clean now, so it is just a matter of getting Google to finish updating their indexes of your site. There should be a way for you to request a review of those pages in your Google Console (Webmaster Tools) account. You can try the manual process of “Fetch as Googlebot” to verify that the Chinese character page does actually render a 404 for the Googlebot when you test that URL, and you can also test the root URL to make sure that Google can fetch your homepage without errors. That will at least confirm that this is just a waiting game.

Some of those code snippets are clearly truncated or missing something from the beginning of the script. It may be true that not all the script in the affected files is malicious but it would help me greatly to see the whole contents of those infected files (including any non-malicious code that might have been in the file before it was appended with these malicious lines of code) so that I can determine the pattern in the affected scripts and make sure that all the offending code can be removed without damaging the syntax of the original code.

Could you please look for a backup on your server that might contain the whole of the infected files and send those to me directly via email attachments?

You can disable the protection for user enumeration on the Firewall Options page in your wp-admin.

I just added this new threat to my definition updates. Please download the latest definitions and run the Complete scan again.

Please let me know if it find this threat in your database or not. If not I would like to take another look at it.

Can you please try the Complete Scan again but this time have the Network and Console tabs open in your browsers Inspector so that we can see if there are any errors preventing the scan from continuing after a minute or two?

Also, you should enable the automatic update feature to get the Core File definitions too if you have not already done that. It will not fix this issue but it may speed up the scan a bit once we get that going.

First: Never trust an AI to give accurate information. This is not in any way evidence of a persistent malware infection. This is simply a feature of my Firewall which protects against URLs with User Enumeration, like the “posts by author” link you are trying to get working.

If you delete my plugin then it will no longer protect against this potential threat, but if just disable that one feature on the Firewall Options page in your wp-admin then you can user links with author IDs and also still have all the other protections that my plugin has to offer.

Please let me know if you need more help or have any further questions.