My Site recently exploited by wp-info.php.
I fixed it by changing the root .htacess file, I removed everything that was added by the virus, kept the below section in the .htaccess:

Then I changed the site folder permission to 755 except the wp-content/upload folder with 777 permission so that media uploads work.

Then virus has stopped working, it was keeping my whole server busy, infecting all other files in the server.