How to find the source of a virus on a website?

Question

CMS

There is a vps, one user in the sites (and only one, the others are all ok), the .htaccess file is supplemented, for some reason only opencart does not touch (this is generally incomprehensible to me) with various redirects periodically - suspicions of a shell - how can you calculate what the jamb is?
ps T.P. first suggested an anti-virus check - the files were deleted - but it remained, then they told me to contact the specialists :)
Now I changed the rights to root on one of the sites, I'll see if it changes or not.
Filling in clean cms is the most extreme option, I don’t really want to resort to it.

Answer 1

In a similar situation, I didn’t find it through what they hacked, but I cleaned everything with the help of this script - www.revisium.com/ai/. finds web shells, etc.