Get Off Those Maliciously Loaded Scripts!
Download this free Anti-Malware Plugin for WordPress.

I see your homepage in your sitemap and there is nothing in your robots.txt file to prevent indexing that page, so I’m would guess that Google just has not refreshed their own cached index of that URL yet. I also still see one listing in the Google search results for your site that shows the Chinese characters you were talking about, but that links to a 404 on your site, so it should also fall out of the search index in time (whenever Google gets around to rechecking the cache they have of that page and see that it is now a 404).
It looks to me like you have done everything right and the site look clean now, so it is just a matter of getting Google to finish updating their indexes of your site. There should be a way for you to request a review of those pages in your Google Console (Webmaster Tools) account. You can try the manual process of “Fetch as Googlebot” to verify that the Chinese character page does actually render a 404 for the Googlebot when you test that URL, and you can also test the root URL to make sure that Google can fetch your homepage without errors. That will at least confirm that this is just a waiting game.

Some of those code snippets are clearly truncated or missing something from the beginning of the script. It may be true that not all the script in the affected files is malicious but it would help me greatly to see the whole contents of those infected files (including any non-malicious code that might have been in the file before it was appended with these malicious lines of code) so that I can determine the pattern in the affected scripts and make sure that all the offending code can be removed without damaging the syntax of the original code.

Could you please look for a backup on your server that might contain the whole of the infected files and send those to me directly via email attachments?

You can disable the protection for user enumeration on the Firewall Options page in your wp-admin.

I just added this new threat to my definition updates. Please download the latest definitions and run the Complete scan again.

Please let me know if it find this threat in your database or not. If not I would like to take another look at it.

Can you please try the Complete Scan again but this time have the Network and Console tabs open in your browsers Inspector so that we can see if there are any errors preventing the scan from continuing after a minute or two?

Also, you should enable the automatic update feature to get the Core File definitions too if you have not already done that. It will not fix this issue but it may speed up the scan a bit once we get that going.

First: Never trust an AI to give accurate information. This is not in any way evidence of a persistent malware infection. This is simply a feature of my Firewall which protects against URLs with User Enumeration, like the “posts by author” link you are trying to get working.

If you delete my plugin then it will no longer protect against this potential threat, but if just disable that one feature on the Firewall Options page in your wp-admin then you can user links with author IDs and also still have all the other protections that my plugin has to offer.

Please let me know if you need more help or have any further questions.

This is due the the Brute-Force Login Protection that you enabled, not because of the donation.

The NO_SESSION_ID error means that your browser was not able to sustain a persistent session during the login process. This could be caused by any number of methods of disabling cookies in your browser, or else something wrong on the server that is preventing PHP from managing the session files for your connections. It could be a permission issue or a read-only partition any some other misconfiguration of PHP on your server.

I see that you have disabled the Brute-Force Login Protection on your website so the issue is no longer present on your login page. If you would like to try enabling this protection again find you are still having this issue with it then I can look at it for you.

Please email me directly for a quicker response and we can work on this to see what is causing the problem and I will find the solution for you.