How to cure malicious code?

Question

Malware

On the site (wordpres) recmovie.ru there was some strange search string with the ability to enter your value. Tapping "search" redirects to go.mail.ru

Attempts to find these ominous lines of code were unsuccessful, but here's what we managed to find out:
217.118.92.254:8080/scripts/toolbar.js - the script itself.
recmovie.ru/00214.js is a duplicate.
Location in the code

Visible only when disguised as a mobile device and loading the page via mobile Internet.
If anyone has dealt with something similar please share your advice. Well, or give a tip in which direction to look.

Answer 1

habrahabr.ru/post/257133 :)

Answer 2

The AI-Bolit scanner will help you.

Answer 3

plus for aibolit, it really helps. only the hosting did not pull, I had to check it on the LAN. if you read the report, you can understand where the vulnerability was and cover it up. on our sites, the problem in the old version of the slider was: revolution slider. what caused the malicious code to be uploaded

Answer 4

Rearrange from a clean copy. The rest is a lottery game, because no AB gives a 100% guarantee.