Hector - OK. I am on it.

Hector - I just checked and interestingly it's coming up as clean on most of the malware scanners and also all of the plugins and themes including wp-core files are already up to date.

I will create a support ticket with the WPengine team regarding this.

Hector  

The WPengine team has confirmed. There is no malware script on the website. As per them since all these spam posts were created by the admin account username - edelmanmd. It could be that this user account got locally compromised. I have now reset the password for this admin account along with two others just to make sure and also deleted all the spam posts.

Below are the new credentials for the client's admin account.

Username: edelmanmd
Password: zZ9iuIoPOzzQBPns(5En3R2o

New password for our Medstar team admin account.

User: medstar
Password: Givemethanos123#@!

Please re-submit the sitemap and let me know if you still see any suspicious activity on the website.

Thank you for looking into this and implementing all of those changes Isaac.
I have resubmitted the sitemap and let Shane know to resubmit the ads approval.
I will update the spreadsheets.

Thanks.

image.png 29.1 KB • Download

Isaac  
Shane says the ads got rejected by Google because they do not think the site is yet clean. 
Can you please check to see why this is happening?

Hector - As per both the hosting and their security company and the new firewall company that we have set up on this website. There is no malware on this website anymore. It's clean. Have we already tried saving the ads campaign?

Isaac thank you for following up and letting me know about all the steps taken to secure this site.
Shane I see the ads back on now so does this mean we are good to go?

Ads are still suspended. 

So what do we do then Shane ? Or better yet, what can we do?

We either need to wait, or bring it a specialist to make sure the hack is fully resolved. 

Isaac is our specialist. And he said that as per both the hosting and their security company and the new firewall company that we have set up on this website, there is no malware on this website anymore. It's clean. 

Isaac  can this be closed?

Alyssa - Yes. Please. Thank you.