If you see these hidden hacker plugins: wp-dester or wp-dest and wpyii2 under your WordPress /plugins/ folder then you need to check the Cron tool in your hosting account for a malicious hacker cron job. Delete these hacker plugins first then delete the malicious cron job. Also delete this folder in your hosting account root folder: /public_html/css/. VERY IMPORTANT!!! Change/switch your PHP version in your control panel. When you change your PHP version in cPanel it resets/kills all processes. Doing that will kill all processes, which is most likely what recreates the malicious cron job. It is a known thing that AnonymousFox hacks do. AnonymousFox hacks attack/hack the server/control panel itself and also your website.
Then do the steps in this hosting account hack cleanup help forum topic > https://forum.ait-pro.com/forums/topic/wordpress-hacked-wordpress-hack-cleanup-wordpress-hack-repair/ and finally use FTP search and replace to delete the .htaccess files that have been created in every single folder under the hosting account.
Note: The hosting account was hacked prior to BPS Pro being installed and required hack cleanup after BPS Pro was installed. BPS Pro does stop AnonymousFox hacks from being successful, but the nuisance .htaccess files will continue to be created until system processes are killed and the malicious cron job is deleted.
Note: These hacker plugins are typically used in AnonymousFox hacks, but their plugin names will most likely be changed regularly. Any plugins in your /plugins/ folder that are not displayed on your WordPress Plugins page are called “Hidden Plugins”.
Note: Check these 2 files /home/user/.cpanel/contactinfo and /home/user/.contactemail for any email addresses that are not yours and delete them.
Recommendation: Turn Off/Disable Anonymous FTP in cPanel.
.
