malware

Yes, I assume this is the same question as posed in our Facebook group.

the .bt attack and other such attacks rely on modifying core WordPress PHP files, and/or plugin/theme files.

Creation of the .bt files is a symptom of the problem, not the hack itself, so detecting changes in the core PHP files is the first line of defense here.

And yes, Shield will detect these changes and repair them if they are in your WP Core files. ShieldPRO will handle plugins and themes.