My site has been hacked. Backdoor_php. How to remove?

Question

Burglary protection

Download the WordPress theme. There was a backdoor.
Yesterday I uploaded the site to the hosting, and today they blocked it due to:

Reason for blocking: {YARA}Backdoor_PHP_WPVCD_DivCodeName : /home/replyuz/public_html/wp-content/themes/discy/functions.php

As I understand it, this is a piece of code in functions.php, should I remove it? but how to find it

Answer 1

And, of course, there is no backup?

As I understand it, this is a piece of code in functions.php, should I remove it? but how to find it

Look at the functions.php in the default WP theme, compare with the malicious one
. How to treat:
UPD: I'll supplement the post a little ...
Maybe fill in the topic somewhere and attach a link, you could take a look. I once treated the topic, the hoster also warned. But the hosts, by the way, there were three of them, on which the bot knocked, were already dead