Client can't log in

Hi-

My client is not able to log in to WordPress. The error message says the password is incorrect, however I am able to log in just fine. We have gone through this many times and I am 99% sure she is using the correct password. I even pointed out that the zeroes were not the letter O, etc.

Her computer was infected with OtShot. She says she has gotten rid of it completely, and her Avast scan comes out clean. I’m not sure she has done a boot scan, though. She is not the most technologically adept (although I have to say she has been a real trooper throughout this.) So, I think a boot scan would confuse and overwhelm her and I don’t want to go there unless I have to.

The site was also compromised. I found a file named header.php.injected09052013 in the root folder. At the same time, a file named .viminfo was created or uploaded.

I deleted those files and insalled WordFence and ran a scan. It did pick up something, but unfortunately I don’t remember what, except that it had to do with Akismet. I resolved whatever it was. Now both WordFence and Sucuri scans are coming out clean, but my client is still not able to log in.

The FTP log for the day of the header injection (assumedly 9/5/13) lists the followng files: wp-config.php, robots.txt, sitemap.xml, .the theme’s header.php, and a file called “6mhd8V2T.gif”. The gif was uploaded to the public_html folder – ofdd place for it and definitely not something I would do.

Gifs with random string names like that since 9/2/13. Between 9/2 and 9/5, also showing in the log is htaccess and a file called “count.php” in the public_html folder.

I have also looked through the files by hand and have seen nothing else suspect. This is a very simple installation of WordPress.

Does anyone have any idea what might be going on? The site scans turn out clean and her computer scans turn out clean, so I am at a loss.

It occurred to me to have her clear her cache, but it’s a bit of a pain to have one’s cookies deleted and I think it would confuse her, so again, I’d rather not if I don’t have to.

Any ideas would be very gratefully accepted.

Thanks,
Kim

P.S. I changed all passwords, updated everything, and created a new db user and deleted the old.

P.S.S. Plugin list at time of hacking: Akismet, Broken Link Checker, Contact Form 7, Dynamic Widgets, Jetpack, Shortcode Exec PHP, Under Construction. They were all the latest version, or one version behind. Same with WordPress.