Examples of WordPress malware damage wp-blog-header.php, wp-cron.php, and .htaccess files are generated by themselves in their own folders

Here is an example of WordPress malware damage where wp-blog-header.php, wp-cron.php, and .htaccess files are generated in people’s folders without their permission.

Numerous wp-blog-header.php, wp-cron.php, and .htaccess files are generated without permission outside the public_html and /var/www folders on the WordPress site’s server.

If this occurs, it is very likely that the site has been infiltrated by hackers and malware or backdoors have been installed.

The reason why wp-blog-header.php and .htaccess files are generated in other people’s folders is that low-quality malware programs automatically spread the infection to all WordPress files on the server and randomly replicate themselves in folders without WordPress files. The reason for this is that the low quality malware program automatically spreads to all WordPress folders on the server.

Why wp-blog-header.php is automatically generated

wp-blog-header.php is a file that is executed each time a WordPress page is displayed. This makes it a convenient file for hackers to embed malicious code for automatic malware restoration or redirect hacks that redirect site users to other sites without their permission.

For this reason, hackers write the malware-infected wp-blog-header.php into various folders. When the malicious code embedding is removed, the infection is overwritten via another malware file and automatically replaced with the malicious file, thereby reviving the infection.

*Not only wp-blog-header.php, but also index.php and wp-settings.php are similar files, so these files may be written without permission.

Why .htaccess is automatically generated

The most common reason why .htaccess is automatically tampered with is often to write settings that prevent administrators from accessing the WordPress administration screen.

Other reasons why malware files are automatically written to the folder

Other times, malware or hackers write fake files that look like WordPress file names such as wp-cron.php, wp-cofiq.php or wp-crom.php into your folders.

The reason for this is often to install a backdoor, a file that provides an entry point into the server for hackers to continue hacking, or to install a program to send spam emails.

Files often installed as backdoors Tiny File Manager
Files often installed as spam mailers: GFX Xsender, leaf mailer

How to deal with malware files installed outside of the WordPress web publishing area

PHP files and htaccess files located outside of the WordPress public domain are basically not executable, so deleting them is the best way to deal with them.

However, if your server has its own system that reads and uses files outside the public domain, you may need to delete them carefully.

Other malware investigation and removal

In addition, once tampering has been found in the server, there may still be malware or backdoors remaining in the deeper layers of WordPress. We recommend that you use a plugin or other tool that can comprehensively inspect and exterminate malware in the server.

Free WordPress:Malware Scan & Security Plug-in [Malware and Virus Detection and Removal].

Plug vulnerabilities

Next, the vulnerability of the site that allowed the hacker to enter in the first place must also be plugged, or the same vulnerability can be used to re-infect the site.

Reference
5 Free WordPress Security Measures