Hello,
I believe our site has been infected but I can't seem to find the source. I have ran all the scans with your plugin, fixed the issues, removed old directories, changed passwords, prefixed the db tables, etc. but every time I try and fix the permalinks the .htaccess overwritten and updated with a default setting and the permissions are changed. I can use an ftp client, delete the .htaccess file, upload a new one and within seconds its overwritten.
I forgot to mention that this is a blog (WP) installed under the main site, also WP. The 404 throws the user to the main site and not the blog which is exhibiting the issues.
Please advise.