WordPress automatically created files like .theme-name / .plugin-name.php [closed]

Ok, it took me a while to figure it out, but at the end I fixed the problem.

The malware infected 99% of the wordpress files. It generated files in 99% of the folders and subfolders and in almost every single files it added the following:

if (file_exists($filename = dirname(FILE) . DIRECTORY_SEPARATOR . '.' . basename(dirname(FILE)) . '.php') && !class_exists('WPTemplatesOptions')) { 

Fix? There’s no way to fix that. At least by removing or editing the files. Every time you try to remove or edit that, all the edits will be discarded and the corrupted files will be uploaded again… and again… and again!

The ONLY solution is to create a clean installation of wordpress, manually install all the plugins (DO NOT COPY THE OLD PLUGINS and ANY FOLDER) and then link the new installation to the (old) database. Indeed, this malware didn’t infect the database. Only the files!

During the process, make sure to create a backup of everything in order to avoid any kind of problems (do the same with the database. I personally created another database and backed up the old one)

Hope this helps