How to find the viral advertisement code in the code?

Question

Malware

help get rid of ads on the site.
Output like this:

<ins class="mrg-tag" data-ad-client="ad-595530" data-ad-slot="595530" style="position: fixed; z-index: 9999; top: auto; left: 146.5px; width: 970px; transform: translateY(0px); bottom: 0px; height: 0px;" id="mailru_ad_595530_1583127778617" data-ad-status="ready">
<style>
#trg-b-29284408-146021346 {
  font-size: 14px !important;
  line-height: 20px!important;
  font-family: Arial, Verdana, sans-serif !important;
  font-weight: 300;
  position: relative!important;
  box-sizing: border-box !important;
  text-align: left!important;
}
#trg-b-29284408-146021346 [data-custclickarea]:hover,
#trg-b-29284408-146021346 [data-clickwrap]:hover {
  cursor: pointer;
}
</style>
<!-- format970x250,1 -->
<style>
#trg-b-29284408-146021346 {
  box-sizing: border-box!important;
  width: 970px!important;
  height: 250px!important;
}
#trg-b-29284408-146021346.trg-b-wrap {
  border: 1px solid #ededed!important;
  background-color: #fff!important;
  font-family: Arial,Verdana,sans-serif;
  font-size: 14px;
}

#trg-b-29284408-146021346 .trg-b-cta-wrap {
  text-align: right!important;
}
#trg-b-29284408-146021346 .trg-b-disclaimer {
  line-height: 1 !important;
  margin: 0 !important;
  font-size: 12px !important;
  color: #999!important;
  position: relative!important;
  text-overflow: ellipsis!important;
  overflow: hidden!important;
  max-width: 100%!important;
  white-space: nowrap!important;
  width: 100%!important;
  cursor: pointer;
}
#trg-b-29284408-146021346 .trg-b-age-limit {
  line-height: 1 !important;
  font-size: 12px !important;
  color: #999!important;
  padding-right: 5px!important;
}
#trg-b-29284408-146021346 .trg-b-discl-wrap {
  margin: 7px 30px!important;
  width: calc(100% - 60px)!important;
  display: flex!important;
  justify-content: flex-start!important;
}
</style> 
<div id="trg-b-pad-276902">
  <div class="trg-b-wrap trg-b-pad-276902" id="trg-b-29284408-146021346"> 
  <img src="https://rs.mail.ru/pixel/AAD07AGWPARP9_D_nuwM7uY_6vJflgSQEFWquyQCZrWPTRSQdVrwzkUX_BkAhwQKF_lw_2AnwE4zwjnQFQ4f8pc6iaEIbijd_aNzIm5P7Ih1h24NdOrKQrR0xp6QaACKYdTbjHe7b9kgdrCUPPEHYouOvz5eDVAiDEvGgTpA000NJwFn0SYesFWpAQAANelvfUBzxFlQkRd6pf1vR88n-OV8J5y4f4iq6P319j9-SCm4Uu-coNgPFvNvqEi1RrZz3ayQrDotSey6XkEtbjC_8ZNpT5v4cpKLBbI0CP_g4ylgt1lj_xMr9eXgLiAlenURAHwEk4gCtAzvMTnX_Mzo6NNwGzUQ2n6tl7D8ZdzlZZTm6uSakFd2dIIp-Iwz2ATTvcUO4NBDQLUxEjzXLBKuxLiLekLQlijlU-AxEPHnrYEckWB2AlP47hAGYjtcZplC4Q6OU3z2vIj-lyA22wanlNFyD4yirAnuKO01i6xAIsVLigJLnICTy8bMiMkWgHVTwq8FKJIP5RS9VDULsHZSGE3i7MF5YbFSs15hTs8RGojVmBYdSEGnZhTc9awvHLAB_N4TJ5Zx2JpFiORsG5WTilpCJWatem-AUTwbQi8bb0RzwqKa3nl8b0xwYguDaaAZc2saGU9d5uncWHsU2_HUPBhAraX5UD5cXPrFa50X0SBCMG2_EbQMLiilESHUJL4ygzLiqG1vlY4htLgNVDqZ-x2Ph5ZZAA4AyVdgbUkodiSWSV6LJ8AiRzebQo7A.gif" style="display:none!important;">
 <a rel="noopener" href="//t.mail.ru/redir/AAD07AGWPARP9_D_nuwM7uY_6vJflgSQEFWquyQCZrWPTRSQdVrwzkUX_BkAhwQKF_lw_2AnwE4zwjnQFQ4f8pc6iaEIbijd_aNzIm5P7Ih1h24NdOrKQrR0xp6QaACKYdTbjHe7b9kgdrCUPPEHYouOvz5eDVAiDEvGgTpA000NJwFn0aeDoA7XAgAAi2FtH0AtskamDkNdphgY76Q06xBNmDzNUzNNhaTOa51ErZmyNjus1mAAxxBv2lcUTU3T--9PUSjNiKQfLFCvDluo6lQjMqG6DL3q4dRdWsbP_JMUCgjMYDHtOKzJSyuOvv0nTm_3XKxdKtaG6TprLq0yxk9yz1qX6MQBEHgYU9w29Jyzs9LZ87IViMPVyw1rF30nMRhFC5YG_AE-_9PPSvcJ_yobvCRdSfDO40jj0RMIqMfZ2VPh_s2HBT_wbX_1RT1DThNEvb1IOoqvk6JPb0EVN2ZnVx8KrMl0DK8pXgNh5zkQtSNZxeexmn-udFuERbDT0ncaUVftXjc48VMunn8KeoQJ2ZfP42ObDZv5h2ODgD0IrcPAnyA7gplRUkye5BFWUAip6lvDAV1XRohodBPHvidal61mhdFtkewdPO-QvwbiheGjR462egn-0pZ8E0Zmo9SWyfcy3jdbLBzdfUm_uKNWWO3HpJ6K8GV7MgNqrSciP0No0dijAALn5-iG_08RDlfxF-zOcLLvFhW8Ox4kIB1dNYfqDN7N_082U6PVtEPeTnCb7g8hau0M4lhMUwgVrEexIW4njJSkTUIJXApb-uVE1w2hxqOG5mK2RSjT_ioWbg7_HMKNcd4P5yR5oZUyYr_17HEhQm52C99OlJ6RrI1i5s9m2SxYL5DWy7mkYz-xakpA3wjvAmyok44e6CeMalkqNzgYuEo4iO66kmcs8P0zItdHqlv9m2LaeR5OXlRMAuORJ7Lm6nssImU-K_L1w3dI9fOl7E31fyplw2UeUJsedNSLjpoX6uQOKDsblOlVmBDhuDiOX57KquBrWhY2yEQO6pMyTT09DSny8l1Y3plBZ1qeyWkgybnjPy9N5C6_mTKN-mNO7Y6FboxrgeM-nQRoc6pJ4y3dFiheWpq8gEZyH7TWbQONdQ_9O_STescBsJh6tbeokuL6xMV6y5bDoGiOPQIcfvOGK4Rw9g" target="_blank" class="trg-b-item-wrap  trg-b-banner  mailru-visibility-check" id="b37522397_1080593526" data-custclickarea="all" data-clickwrap="wrap" data-closewrap-container="b37522397_1080593526" data-trg-id="37522397">

......</ins>

Where can I find it on the server?
Site on WordPress

Answer 1

I also have many sites where there is no SSL certificate. After several checks, it turned out that the substitution takes place at the level of the provider (Rostelecom).

Answer 2

Step 0 - check for viruses, for example using Aibolit . Often helps if it's a virus.
Step 1 - you need to try turning off the plugins (if any) and see if it's possible in them. Then we sort out the culprit.
Step 2 is to investigate the functions.php file and everything that connects to it, because one of these files may contain malware.
Pay attention to large chunks of obfuscated code that shouldn't be there - it's very likely that this is it.
Step 3 - see what scripts are connected to the site and what they do. Perhaps one of them plays for another team. Open the Network tab in devtools, all extraneous and suspicious requests are our clients.
Step 4 - review the entire topic, because it can be sewn up right there. If it appears on all pages, then most likely these are files that are used everywhere. Usually these are header and footer, but there may be others.

Answer 3

This is not advertising on the site, this provider mixes. Identifier ad-595530 - Rostelecom account. Install SSL.