Hi guys,
I would like to add some advice here that it is good to turn on access.log in your hosting where you can discover the source of modyfing the files.
My hosting found the problem with explorerpro since the really beginning and that's why I open this topic on this forum.
The exact suspicious logs were:
2020-08-17 00:15:14 sid-239 nginx 23.101.182.117,us POST /modules/explorerpro/action.php HTTP/1.1 200 (www.domain.xx/ 127.0.0.1:5080 -) [17/Aug/2020:00:15:10 +0200] - sec=0.005 0.006
2020-08-17 00:15:14 sid-239 nginx 23.101.182.117,us GET /xsamxadoo.php HTTP/1.1 200 (www.domain.xx/ 127.0.0.1:5080 -) [17/Aug/2020:00:15:11 +0200] - sec=0.003 0.003
My websites seems ok after restoring backup and delete module explorerpro.
Also do not forget to update these modules:
1-Click upgrade: v4.10.1
Cart Abandonment Pro: v2.0.10
Faceted Search: v3.4.1
Merchant Expertise: v2.3.2
PrestaShop Checkout: v1.2.9
Good luck!