# File recreate after deleting in wordress website due to malware

**URL:** <https://onehack.st/t/file-recreate-after-deleting-in-wordress-website-due-to-malware/102959>\
**Category:** Discussion & Solutions\
**Tags:** solved\
**Created:** [August 25, 2020, 6:53am UTC](https://onehack.st/t/file-recreate-after-deleting-in-wordress-website-due-to-malware/102959 "2020-08-25T06:53:27Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![md\_razu](https://onehack.st/user_avatar/onehack.st/md_razu/32/48113_2.png) [@md\_razu](https://onehack.st/u/md_razu)\
**Post date:** [August 25, 2020, 6:53am UTC](https://onehack.st/t/file-recreate-after-deleting-in-wordress-website-due-to-malware/102959/1 "2020-08-25T06:53:27Z")

</div>

Hi, i found i a file in my core wordpress installation which recreate after i delete that.No matter how many times i delete that.And by googling i found that this file related to JSON Web Token (JWT), which can be used by hackers to gain access.as i can not delete that file i assume it is malicious..i talked to the siteground support and they said they have nothing to do.There are lot of hackers there, i hope you guys can help with the removal.The file is located in wp-admin.  
File name: e9e6c70243f58b4144b87db4e3541ed9  
File-content: [https://docs.google.com/document/d/1yYvS\_HOpR\_XFHJBYssbBeARK7wqLH7BgPh-S120oDNE/edit?usp=sharing](https://docs.google.com/document/d/1yYvS_HOpR_XFHJBYssbBeARK7wqLH7BgPh-S120oDNE/edit?usp=sharing)  
You may find these helpful:

1. [https://medium.com/101-writeups/hacking-json-web-token-jwt-233fe6c862e6](https://medium.com/101-writeups/hacking-json-web-token-jwt-233fe6c862e6)
2. [https://habr.com/en/post/450054/](https://habr.com/en/post/450054/)

Thank you

---

<div class="post-metadata">

**Author:** ![HackedHack](https://onehack.st/user_avatar/onehack.st/hackedhack/32/26738_2.png) [@HackedHack](https://onehack.st/u/HackedHack)\
**Post date:** [August 25, 2020, 9:46am UTC](https://onehack.st/t/file-recreate-after-deleting-in-wordress-website-due-to-malware/102959/2 "2020-08-25T09:46:28Z")

</div>

Do not use nulled themes/plugins as they lead to these kind of issue.

You have not explained how you recreate your site. Please explain so that some one will help you . give more details