I keep getting a file called "wp-sil.php" uploaded to my one specific folder. When i copy the file to my desktop so I can examine it, it removes itself.
When I open the url sting live on my website, I see the entire folder content and options to delete/edit/modify.
At the bottom there is a signature: https://www.google.ca/search?q=B+Ge+Team+File+Manager+Version+1.0%2C+Coded+By+Little+Wei&rlz=1C1CHBF_enCA711CA711&oq=B+Ge+Team+File+Manager+Version+1.0%2C+Coded+By+Little+Wei&aqs=chrome..69i57j69i64l3.330j0j4&sourceid=chrome&ie=UTF-8
Of course I deleted the file from each folder that I found it in but I am worried it will come back again.
I have changed every password I could think of, changed all ftp access and only have a few people accessing the ftp (to a specific folder), added godaddy's malware protection to scan everything and it came back with nothing. I blocked a bunch of different country's IP addresses.
I back up the files weekly so I am not worried losing anything but it will cause an slight inconvenience if the current live files are effected.
Is there a way to block a filename from being uploaded or block unauthorized uploads in general? Or at least check who is behind this?