Defender file scan of core and plugins finds suspicious files quickly. Scanning for suspicious code is very slow and often freezes around 30%. Defender removes two suspicious files and they reappear within minutes. I’ve used another malware remover to confirm dodgy files have been removed.
/var/web/site/public_html/wp-admin/601b3006b052411f7eaa9a14103d1103
/var/web/site/public_html/wp-admin/network/601b3006b052411f7eaa9a14103d1103
Each file has one line of characters, like an API key but not sure what it’s for.
I’ve applied all the security tweaks in defender. I’ve removed a lot of unused plugins. I’ve added IP bans and 2FA auth on users. The site is hosted on WPMU and is multisite.
How else can I stop this happening?
