Hi,
I’ve been helping a friend with EXACTLY the same problem. I’ve been through his files moving and deleting suspicious files.
I’ve recently installed the sucuri plugin (https://br.www.ads-software.com/plugins/sucuri-scanner/) and I’ve been checking its dashboard regularly (deleting the files that should not exist and restoring the ones that are hacked). After the last sweep I thought we were in the clear, but today more hacked files appeared.
We have an open ticket with his hosting provider. If I discover anything I’ll come here to share with you. Hope you do the same.
Regards!
