Start here first

I spent hours – actually days – trying to figure out how to find the malware and remove it but it was literally being added as fast as I could remove it through a vulnerability on one of my other plugings (Gravity Forms). Finally when I used the gotmls I removed all malware and identified the backdoor vulnerability to solve the problem.