Scanner says core files were modified? Open the diff. After wp2shell, that is often leftover access.

Troubleshooting

Deactivate the plugin via FTP

Disable Security Ninja when you cannot reach wp-admin by renaming the plugin folder over FTP.

If wp-admin is unreachable (for example after a firewall lockout), deactivate Security Ninja from the filesystem:

Connect with FTP or your host file manager.
Open /wp-content/plugins/.
Rename (preferred) or delete the plugin folder:
- security-ninja (free / standard package name), or
- security-ninja-premium (if that is the folder name on your install)

WordPress will stop loading the plugin. Log in, then reinstall or rename the folder back when ready.