Chad

Hi @binarywc,

The TinyMCE folder is in the root of the website and is not a plugin or theme. This virus adds this folder among other random .php files throughout the folder. I’ve done these steps before but the virus still comes back. Is it possible this could be from a level higher on the server?

I updated PHP version to 7.1.29 and received the error – “The site is experiencing technical difficulties. Please check your site admin email inbox for instructions.” I reverted back to 7.0.33 and website worked properly, so I changed it back to 7.1 and renamed the plugins folder to see if it was a plugin issue. I discovered it was the Revolution Slider plugin – The current version I am using is this 5.0.4.1. Hope this helps diagnose the problem!