anonymousfox

malware anonymousfox has attacked several of my sites hosted by cpanel.

malware will overwrite the main username with anonymousfox
malware creates an e-mail address in cpanel
malware creates php files e.g. xkjsfnadl.php in wordpress

how do I proceed with the removal?

I tried
in phpmyadmin, I rewrote the main username and reset the password.
changed all passwords
removed malware scripts
deleted email address

malware was back within 24 hours.

I have 10 sites infected.
thanks.