Does a virus constantly change the rights to the site files on Wordpress?

Question

Malware

The site had viruses that were later neutralized by the Wordfence plugin. But there seems to be something left.
The symptoms are:

• Something is constantly changing the permissions to the site files
  
• Wordfence plugin stopped making changes to .htaccess file
  

Is that possible? If so, where to look for the villain?

Answer 1

You have a shell script somewhere. Ideally, you need to reinstall everything.
Wordpress without fail, theme and all plugins. If there are several sites on the server under one user, then such an enemy can be in any of them.
If you have access to the server via SSH, then run the command
or
The "dot" after find means to search in the folder you are in, replace it with the path to the folder where your site or sites are located, or even replace it with a slash / then it will search all over the server.
The command looks for files in the content that contain the text "x63" or "x47". In 99% of cases, the encryption of enemy viruses consists of such codes. Pay attention to the files that the command finds. Open them and see the content. You will immediately see the virus code, it is all base64 encrypted and there are eval commands. Clean or restore these files to clean ones.