Virus on the site, how to completely remove it?

Question

Fight against spam

Hello. Every day hosting blocks the site for sending spam. Randomly, a .php file appears in the directories and a mailing list is sent from it. How to fix? What I did:
1. looked through all the files for left code - done
2. removed wp, plugins and reinstalled - done
3. checked all js for the presence of code (online, through many online checks) - done
4. looked through the database for the presence left records - done
5. checked all the code again - done
6. deleted contact form 7 - we are waiting for the result, the mailing list is activated - I'll see what happens.

Answer 1

Most importantly, have the passwords been changed?

Answer 2

Upload a known clean copy with the removal of all old files. No method of "search" gives 100% guarantees.

Answer 3

And the hoster does not give logs? why not see them?

Answer 4

>deleted wp, plugins and reinstalled
There may be shells in plugins.
The best option is to demolish everything (back up the databases) and reinstall it.
+ you can drive AIBolit'om.

Answer 5

Try Manul

Answer 6

Most likely the site has a nulled version of some plugin installed. Look for the presence of large images in the folder with such a plugin, that's just the shell in them.
If the hosting is VPS, then most likely the malware has already added keys to access the hosting via SSH, so even changing passwords may not help.