looking for help , for one of my Baikal is Hacked (again) i change all default passwords from last reset  , cant understand how he access to it, look backdoor from baikal

the hacker can add a pool, visible on graph page , and auto switch on this pool after every reboot , but this pool cant be see in miner page so cant be removed

i looking to how access cg miner config (pools) via terminal ....any help appreciate , want to fix this without reset sdcard , thanks friends

looking where is located cgminer or pool config via ftp , ssh or else