[URGENT] Self Healing WordPress Malware Keeps reinfecting across 30+ sites on same housting - Please help 😭
I'm dealing with a persistent, self-healing malware infection across ~30 WordPress sites on the same cPanel shared hosting account (A2 Hosting).
Symptoms:
· Files reappear seconds after deletion
· mu-plugins/nexus-router-run.php (empty 0-byte file) keeps coming back
· Advanced-cache.php, db.php, and .g_*.php files in wp-includes
· Shared memory segments (shmop) storing payloads
· Processes like .g_98130eea.php running even after file deletion
· .user.ini files with auto_prepend_file pointing to backdoors
What I've done:
· Replaced WordPress core with fresh files
· Replaced all plugins from official sources
· Replaced Astra theme from official source
· Cleaned database (removed sc_, wp_91_, transient_sc* options)
· Changed database name, username, and password
· Regenerated WordPress salts
· Killed all .g_ processes
· Cleared shared memory (ipcrm)
· Deleted all .user.ini files
· Deleted all mu-plugins
· Deleted advanced-cache.php and db.php
· Disabled all cron jobs
· Changed cPanel password
The problem:
Shared memory keeps coming back (new segments appear), and the .g_ process restarts. Something is recreating it. I suspect it's either:
· A system-level cron job outside my user
· A hidden backdoor in another infected site
· Something at the server level A2 Hosting needs to handle
Questions:
- Has anyone dealt with this specific "Crux Runner" or "SC_" malware family?
- How do I find what's re-creating the .g_ process?
- Is this a server-level infection that only A2 Hosting can fix?
I've spent days on this. Any help appreciated.