Possible solutions of your questions

Hello. your sites are infected and sent out spam. the server ip was black listed because of the sites on your account. You need to clean the sites from viruses and carry out updates. now we`ll scan Your account completely and will provide a report for work. then you soobshaet from what ip you will be working and we will open for You the access

Then You have not fully complied with the cleaning or did not update. wait for scan results

this report

smim.testvt.empire-host.ru/AI-BOLIT-REPORT-__-473997-16-08-2016_13-00.html

performed a re-examination

etcet

http://smim.testvt.empire-host.ru/AI-BOLIT-REPORT-__-235050-16-08-2016_13-27.html

in these files the malicious code. open and check the front line

take for example /home/smim/public_html/jilcru/wp-admin/includes/class-wp-style.php the file fully with malicious code, the virus

there is certainly

for You is the file

public_html/jilcru/wp-admin/includes/class-wp-style.php

and You have opened the file itself public_html/original_JILC/wp-includes/class-wp.php this file is in standard distribution?

we don`t know if it`ll affect rabotosposobnosti, you need to clear the sites from viruses

Affected, this is a system file of the website.

Replace the file with original from the distribution.

please Wait.

open the report, where it States

don`t place the report file on the server, and do not let him direct links from other sites. Information from the report can be used by hackers to hack website, as it contains information about the server settings, files, and directories.

that`s why he`s in the lists and not potamu that it is what a code

account re-scanned

the sites still zarazeny

http://smim.testvt.empire-host.ru/AI-BOLIT-REPORT-__-893493-16-08-2016_16-18.html

in each of the marked files predonzani code

some are all viruses

for example highly doubt that the file /home/smim/public_html/original_JILC/wp/wp-includes/m.php belongs to.

when you have changed? the latest report

the kaky changed

here is the file for example is also

solid virus

/home/smim/public_html/original_JILC/wp-content/themes/twentysixteen/css/css.php

you opened this? it is in the original site?

do so now

download the files to your computer

independently verify antivrus

https://revisium.com/kb/scan_site_windows.html

then zagruzat them hosting

unable to make backup to panel and download the one archive.

or to contact them https://revisium.com , they can clear sites and install them protection.

the sites must be updated regularly

all of the files you will reconsider , and not only those kotoyre we write in the ticket

here`s the virus

/home/smim/public_html/original_JILC/wp-content/plugins/ishare/images/files.php

file a few months

stat /home/smim/public_html/original_JILC/wp-content/plugins/ishare/images/files.php
File: `/home/smim/public_html/original_JILC/wp-content/plugins/ishare/images/files.php’
Size: 8389 Blocks: 24 IO Block: 4096 regular file
Device: fd04h/64772d Inode: 19550222 Links: 1
Access: (0644/-rw-r--r--) Uid: ( 1525/ smim) Gid: ( 1525/ smim)
Access: 2016-08-16 16:06:57.552075509 +0300
Modify: 2016-05-21 19:56:30.000000000 +0300
Change: 2016-06-15 15:30:47.471115245 +0300

ok

if you need another report, tell me, do

running the scan, a report will be otpravlen into Your Inbox.

You can early it download itself on the computer, and wished to remove and to double-check the website 

Specify which sites you have now is not working.

the Request sent to the administrator.

jilc.ru there is no lock. But it`s not working. What you do with it removed?

here`s that script?

[20-Jan-2016 11:16:39 UTC] PHP Warning: require(/home/smim/public_html/original_JILC/wp-includes/pomo/mo.php): failed to open stream: No such file or directory in /home/smim/public_html/original_JILC/wp-settings.php on line 85
[20-Jan-2016 11:16:39 UTC] PHP Fatal error: require(): Failed opening required `/home/smim/public_html/original_JILC/wp-includes/pomo/mo.php` (include_path=`.:/opt/alt/php56/usr/share/pear:/opt/alt/php56/usr/share/php`) in /home/smim/public_html/original_JILC/wp-settings.php on line 85

right , it is not a site requires it. so not working

we bring You the text of the error which vojnike IRDP zapusk e.

it Oksana that the site asks  the file

(/home/smim/public_html/original_JILC/wp-includes/pomo/mo.php

now we koperweis backup

the website sarazen

http://original.jilc.ru/AI-BOLIT-REPORT-__-458914-20-08-2016_11-45.html

astronaute

it is also serusaem

http://original.jilc.ru/AI-BOLIT-REPORT-__-458914-20-08-2016_11-45.html this is a report and not infected file

otkroete. it is the result of the check after download the files from backup. and устран6ите what is in the report

it did not take off, it needs re-skanirovat

no , not added

scanning the automatic. it`s not a problem

http://original.jilc.ru/AI-BOLIT-REPORT-__-410404-20-08-2016_12-14.html

should legallity viruses and clean the files of the website in which malicious code

here`s another

jilc.ru/AI-BOLIT-REPORT-__-217107-20-08-2016_12-21.html

why did you deleted without checking. remove have knowing what you are doing. not Udaltsova and move . if a file is important.  that kzhe files can be simply infected. you just need adultt kad from file

what are you comparing?

replace the file on your original. there neodin file.

It is original?

this file you have

file uploaded

you sent it off for analysis?

send this file