I uploaded this helpful PHP script to github so that it would be easy for you and others to download. I used this script to restore the corrupt core files on your site.
Here is the link:
https://github.com/gotmls/WordPress-Core-Files-Integrity-Checker/blob/master/GOTMLS_Restore_WP_Core.php
Just place this PHP file on your site then path directly to it in your browser and it will check your core files and let you restore any files that have been altered (even if your WP site is broken).
Oh, sorry, I thought you were able to restore it from a backup, but I see now that you were referring to another site.
If you want to send me an FTP login to you server then I can manually restore the site from the quarantine.
I just release a new plugin update that fixes this issue.
Please download the new release, version 4.15.27, and let me know if that works for you.
There should be a button to enable the Brute-Force Protection if it is compatible with your server, otherwise you should be getting some kind of error.
If you need more help with this can you send me a screenshot.
It is possible that an infected computer would infect the post content or that a Key Logger on the client’s machine gave the user’s login to a hacker so that they could infect the content. But it could also just be a coincidence and the hack could have come in from a backdoor or another vulnerability.
My plugin is designed to fix the Known Threats for you automatically. I don’t mind helping when help is needed but the whole point of my plugin is to help people cleanup their own site without needing to hire a professional.
You have not stated that you even tried to fix the malware that was already detect. Can you please use the Automatic Fix button in my plugin and then, if you still need more help, please let me know what my plugin was unable to do for you so I know what kind of help to offer?
Sorry for the delayed response. My plugin does block some common attack but I would hesitate to call it firewall. To be honest I don’t like any of the firewall plugins I have seen, most of them are a little over zealous IMHO, and some of them don’t even work. You have to be careful with any form of protection that you don’t lock yourself out 
The malware probably overwrote your .htaccess file. You just need to restore the Permalink Settings to “Post name” or your ” Custom Structure”. That will fix your .htaccess file.
If you are sure that there is no gotmls folder in the plugins directory, and then you install it through the “Add New” method in the plugins admin page (/wp-admin/plugin-install.php) and then it should show up in you list of plugins, and if the standard install method was successful there should now be a gotmls folder into /wp-content/plugins/ when there was not before.
can you confirm that it creates the gotmls folder in the correct path and that there are no errors from the WordPress Plugin Installer?
Maybe there are too many sub-directories in the public_html and the Complete Scan is consuming all the memory PHP allocates while indexing all those folders. Or perhaps there is a recursive symlink somewhere in that path. You could try experimenting different Scan Depths other than -1, try positive numbers under 10.
It hard to say exactly what is causing this white screen on your site. It could be that another security plugin you have installed is inadvertently blocking my plugin or the malware on your site is causing a 500 error.
Check your error_log files. If nothing there then try temporarily disabling any other firewalls you might have and try again. I’m assuming you tried both the Quick Scan and the Complete Scan but I would recommend the Complete Scan for troubleshooting a problem like this. You should see something come up within 60 seconds of when you start the Complete Scan. If not there is either a fatal error that is crashing the scan or other code is blocking the results page.
Let me know what you find.
It looks like even sucuri is showing your site as being clean as of a few days ago. Would you be willing to post a follow-up to let us know how you resolved this?
It looks like your server cannot sustain a persistent session.
You should not have been able to Enable the Brute-Force Protection without a working session, but maybe your session capability only broke after the protection has enabled.
In any case, you need to manually disable this login protection now so that you can get back into your WP Admin, and there are two ways to do this with FTP or File Manager access to your server. The simplest way to disable the Brute-Force Protection without disabling the plugin is to delete the safe-load folder inside the gotmls plugin folder. The second way is a little harder if you don’t know anything about PHP, but would be better in the long run, is if you can edit the wp-config.php file in the root directory or the site and rem out the require_once line at the top of the file by adding // right after the first
@programmers,
I have upgraded the scan depth on both the keys your sent me. Please download the new Definition Update and you should be able to scan the other sites in the www/public_html directory.
Please note that the Complete Scan may take a very long time to finish if there are a lot of sites in the scan path.
I discovered that there was a malicious javascript redirect in the settings for the fancybox-for-wordpress plugin. So I installed my SQL Reports plugin and searched for the mfbfw value in the wp_options table and deleted it. Now your site does not redirect on my mobile device 
