Happening to us too. I’ve also taken the above advice from rioyotto and renamed the link-template file and changed the wp-settings – an excellent idea. But we’ve also had other files renamed *.php.suspected. Seemingly at random.
The mystery is that we have many WordPress sites on a dedicated server and only one is affected.
Wordfence came up with a list of seemingly dodgy files and we cleared all of those out. Wordfence is currently clean.
We’re all over this like a rash and if we come up with anything, we’ll post immediately.