How to finish off a virus on a site - injection via url?

Question

MODX

Good day, developers!
It turned out that the site on MODX of one of the old clients was hacked. Google wrote "The site has been hacked and is spamming", in detail that this is an injection via url. Since the hoster did not have an up-to-date, clean backup, he deleted all the left files manually, then rolled up the update from above, removed the core folder from public_html. But Google still continues to notify that the site has problematic pages, like site.ru/b4union0505a849fc86c6et-m/j_qu2mall-b00u2g7it80d.co , but if I open them, it gives a 404 error.
After my update, the files were not corrected, but where does Google get these pages from and in which direction to dig?

Answer 1

Check again with the help of aibolit https://revisium.com/ai/
Google does not immediately remove the threat of hacking, you need to wait for re-indexing.