How to detect the source, the script that sends virus POST requests?

Question

PHP

A person close to me asked me to figure it out, to help with the design of the blog (google platform) and now, after a while, they turned to me with the same request, but now it’s not about that ...
I logged in from the account (owner of the blog http:// Content not found/) and a minute later I find strange requests, I guess the reason for this: a merged pass and writing malicious code into the HTML body
Requests:
Content not found
And the main question: how to find this malicious code in an infected blog?
We are changing passwords now....
upd: issue resolved

Answer 1

This usually happens after installing various widgets or even pictures from unverified sources.