How to catch a virus on a website powered by OpenCart?

Question

Malware

There is a site on OpenCart prima.istark.ru
After yesterday's update of the module, it began to behave strangely. When you click on the link, it opens the "advertising" site in a new window.
The screen recording can be viewed here, uploaded via DropBox: https://www.dropbox.com/s/fdl9xlpuyenu888/%D0%9D%D...
The problem is that the "virus" disappears, it shows "advertising" pages, then no. But at the moment when it shows - I checked it on 3 computers under different operating systems: WinXP, Win7, MacOS - it shows ads.
Therefore, the infection of the computer with a virus was discarded immediately.
How to fix it? Where to look?

Answer 1

go to ftp, download the site, then set doctor web on this folder, you will find out what kind of vir, then according to the circumstances.
PS
I don’t know how “correct”, this is how I did it myself)

Answer 2

You can use the file search. Find the eval() and base64_decode() functions and check if they execute harmful code, remove them.
To search for files on the server, you can use the varvara.php script, if the files are on your computer, you can search with the PowerGREP program.