thumbnail jpeg keeps causing file monitor alert. possible hack?

review info in these resources:

https://codex.www.ads-software.com/FAQ_My_site_was_hacked
https://www.ads-software.com/support/topic/268083#post-1065779
https://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/
https://ottopress.com/2009/hacked-wordpress-backdoors/
tutorial how to fix hacked WP blog: https://www.jtpratt.com/how-to-fix-a-hacked-wordpress-blog/

Then implement security tips of this guide to harden your WP installation: https://codex.www.ads-software.com/Hardening_WordPress

Malware Scan: https://sitecheck.sucuri.net/scanner/

Thanks. I’m familiar with those links. I was hacked once before and had to rebuild my site from scratch thanks to faulty backups. I implemented almost all of the wordpress hardening tips plus other security site tips, installed numerous security plugins, file monitoring systems, regular scans, etc.

Rather than tips for recovering from your average hack, I am looking for feedback on whether thumbnail modifications occur regularly for people, and any clues as to what might cause the sort of activity I have described. Would a thumbnail be changed by browsing or caching? Would jquery or lightbox or something like that cause a hashtag to change? Are there ways to check if a jpeg has been injected with code? I need to try to determine if what I described is perfectly normal or sounds out of the ordinary.

I’m trying to find my last clean backup and not sure if thumbnail modifications are a sign of a hack or just business as usual.

So, when I originally posted I suspected I had already been hacked (due to some other issues) and wasn’t sure if this was involved. I have since concluded the other issues were not a hack, so my site appears clean.

I also re-examined the file monitor change log of the thumbnail jpeg that keeps popping up and the file hash remains unchanged, as well as the name. So the only thing that appears to be changing is the date of modification. I tried deleting the thumbnail file, then revisited the site page that uses that thumbnail, and a new file was created by the image resizing script. I hoped that might take care of it, but it is still popping up almost daily in my file monitor. No idea why.