#wordpress

Step-by-step for an infected WordPress site: top to find the rogue process, lsof to locate the file, chmod 000 + chattr +i to neutralize it, then dig through cron and core.