Malware

I sure hope someone can help with this, because it’s been an issue for almost 3 weeks and is driving me insane.

I manage 8 websites, all on Ionos (my host). All of the websites keep getting infected with malware. I clean them, and then they get re-infected.

A timeline:

1.) My host detects the malware and sets permission to 200 for index.php, wp-settings.php, wp-config.php, and sometimes wp-includes/load.php

2.) I check the files, and there’s always some stupid line of code the malware inserted at the top, referencing a .OTI file.

3.) I replace with new, untampered copies of these files and change the permissions back to 644.

4.) I run a scan of my entire file system for .OTI files and delete them.

5.) All is good, all websites are back online and normal, and then I wake up the next morning and they’re all down again. Permissions changed back to 200 because the malware was re-inserted.

What I have done so far:

1.) Download WP Activity Log, Wordfence, and Anti-Malware from GOTMLS. Ran scans and fixed all the files in quarantine.

2.) Enabled multi-factor authentication on all of the sites, changed their passwords, and even changed the SQL database passwords. Also reset the password for my FTP account.

Also would like to include that randomly I’m finding admin.php and options.php files in the root WP directories, as well as /themes, /plugins, etc.

Any ideas here would be SO helpful, and I appreciate the time.

PJ