How to remove malicious code from a WordPress site?

Question

Data protection

Hello dear associates.
I need your help. One of my websites has been infected with malicious code. Hosting Siteground platform Wordpress.
The essence of the malicious code:
A new folder with a short name appears in the root of the site (although it was previously in the wp-admin or wp-includes folder). It contains several php files, .htaccess robots.txt and so on (if I have an example)... The hoster and Google have already warned and banned the site several times. I delete folders - everything becomes normal. Well, the problem is that they regularly appear again! I don't know what to do anymore. It's
worth premium Wordfence, Sucuri (not premium) - they find it, but only after this one appears in the directory. But I do not understand how to make sure that the virus does not appear. My fantasy is over.
Scanned, reinstalled everything, changed all passwords, searched through ssh for the latest changes ... All to no avail.
Maybe someone had a similar problem? Many thanks in advance for your help.

Answer 1

I use aibolit + check the plugin archive before installing it on virustotal

Answer 2

save the logs in a parallel file xs
will it work on
most probably not

Answer 3

You need to start by reinstalling everything, starting with a clean VP, then clean up the code. Plugins won't help here.