Web shells: remove the attacker’s access, not just one file
An unexpected server-side script may provide an attacker with continuing access. Removing that file is only one step; you also need to understand how it arrived and what else changed.
Backdoors
Backdoors