How to find a virus that recreates deleted files?

Question

Malware

Good day!
There is a VPS hosting with CentOS 7. I
got a virus, when I try to clean it out - some files are returned immediately after deletion.

Is it a virus in the system? Can anyone come across? How to clean it with fucks?

There are several sites on the same hosting, only one infected with Wordpress 5.0.3 without plugins.

Answer 1

In general, the point was that the virus somehow registered in Wordpress'a tasks.
So far, this is the solution:

• delete file wp-cron.php,
  
• clean up the remnants of the virus,
  
• update Wordpress to version 5.1.1.