file .bt?

You might want to provide a little more information.

Which directory is this new file in?

Did you just notice this new file? How old is your site?

found the same files today on a customer account. it seems its used to share torent files… there should be also a new file in root folder named wAr3z.php or other names… the bt file is located in wp-admin and maybe some plugin folders too. delete the files, check and delete old not updated plugins. after deletion , change all passes to be save.

Kind Regards,
RS

oh and check the wp-load.php there is a code injection too wich builds the .bt again and again.

@rs-systems – Thank you so much for mentioning the script being there in the wp-load.php.

How is this script getting added in wp-load.php, any idea?

Even after removing the script from wp-load.php, the .bt file is still getting created. Not sure how!

You’ve been hacked.

Remain calm and carefully follow this guide. When you’re done, you may want to implement some (if not all) of the recommended security measures.