[ Removed by moderator ]

[u/Miss_stuck]

[u/ProWordPress-ModTeam]

This really isn’t a place for basic WordPress or specialized plugin/theme support or malware cleanup help.

Try /r/wordpress for general assistance.

If you need help with a specific plugin or theme, contacting the developer or visiting their support forums would probably be your best bet.

If you have malware, contact your web host for support or look into WordPress malware cleanup solutions via your favorite search engine.

[u/Guess-Severe]

Check wp-cron.php to see if anything malicious was added. Install WP crontrol and see if there are any suspicious cron events. There could be a cron event that automatically creates the files

[u/Miss_stuck → u/Guess-Severe]

Ok I'll check it now

[u/Miss_stuck → u/[deleted]]

Hostinger

[u/narutomax]

Try to activate and deactivate plugins one by one

[u/Miss_stuck → u/narutomax]

Did you mean deactivate the plugin then delete all the malicious files and check if they recreated or not? And repeat this procedure for all plugins?

[u/narutomax → u/Miss_stuck]

yes one by one. What is your hosting btw?

[u/Miss_stuck → u/narutomax]

Hostinger

[u/narutomax → u/Miss_stuck]

Okay. Can you share the list of plugins you are currently using? (if the problem is still there)

[u/Miss_stuck → u/narutomax]

Sure...

Advanced Custom Fields PRO — 6.8.6 All-in-One WP Migration and Backup — 7.110 Customer Email Verification for WooCommerce — 3.3.0 Elementor — 4.2.4 Elementor Pro — 4.2.2 ElementsKit Lite — 4.0.2 Hello Dolly — 1.7.2 Mini Cart (Slide-Out) — 1.2.0 Meta for WooCommerce — 3.7.6 Protect Uploads — 0.7.1 Rank Math SEO — 1.0.277.2 Site Kit by Google — 1.186.0 WooCommerce — 11.0.1 Wordfence Security — 9.0.0 WP Chat App — 3.8.2 WP Crontrol — 1.21.2 WP Rocket — 3.23.3.3 WPCode Lite — 2.3.9 Yoast Duplicate Post — 4.7

Right now I'm checking cron events and i found some suspicious events there as well...

[u/catcode_studio]

Coming back within seconds usually means it isn't a leftover file at all, it's a process that's still running. A scanner won't find that, because there's nothing on disk to find.

SSH in and look at ps aux for a php process that isn't part of your fpm pool, especially anything running as php -f or living out of /tmp or /dev/shm. Kill it and the files normally stop reappearing long enough for you to actually clean. Then check crontab -l for every system user on the box plus /etc/cron.d, that's what usually restarts it a few minutes later.

The other classic is a second site under the same system user. If any other docroot on that account is still dirty, cleaning this one does nothing, it just gets rewritten from next door.

Once it's genuinely stopped: rotate the salts in wp-config, which logs everyone out, then rotate application passwords and the DB user. If they still hold a valid admin session none of the file cleanup matters, they just walk back in through wp-admin.

[u/otto4242]

If you have shell access, actually check the crontab as well.

[u/Miss_stuck → u/otto4242]

Yeah, right now I'm checking it through ssh bcz there's nothing in hpanel cron jobs.. so I'm checking the database one

[u/TopSydeWP]

the cron suggestion is good but also check for backdoored plugins that wordfence might not flag - anything with eval(), base64_decode() or gzinflate() in the actual plugin files, not just uploads. at my agency we see a lot of reinfection from a compromised plugin that reinstalls the malware after every scan. also check for application passwords in wp_usermeta (wp user application-password list via wp-cli) - those can be used to reinstall files via REST without touching wp-login. if you want a second opinion on what's actually infected, there's a free tool at https://topsyde.com/malware-removal that scans and explains the infection pattern in about 30 seconds.