Hi, there is some malware somewhere in my website that creates 50-70 MB files with the name “core.xxxxx” (where xxxxx is a number) in the /public_html and /public_html/wp-admin directories, on a frequency ranging from 1 per minute to 1 every other second. I am frantically deleting them as they are generated.
I have identified and removed a modified .htaccess file, as well as some .php files (about.php and admin-ajax.php in /public_html/wp-admin), and I replaced them all with backup copies. There is a process
/home4/abovethepath/public_html/wp-admin/admin-ajax.php 19005.8% 32.0%
running, but I replaced the admin-ajax.php file, so… I don’t know what’s going on.
Is anyone familiar with it and if so, do you know how to remove it?