The wordpress site loads the left .js, how to find the source?

Question

WordPress

One of my sites loads a script from www.29wp.org/jquery.js. I searched for this domain - I could not find anything, except that the domain was registered in Panama. Before that, I found a lot of phpdoors on the same site. The question is how to detect the reason why this code is still being added to the page and "cure" wordpress?

Answer 1

1) Check the theme files - in particular the header footer functions
2) Check the plugins (if there are "premium" nulled plugins, then delete them or check their files)
3) Scan with Wordfence
4) Check the database for "extra" tables
5) Install Query Monitor, find the handle of the script that is being loaded and deregister (In the event that it is not a virus, but just a jquery plugin)
PS do not forget about base64 and that the link can be encoded. Well, at worst ... download the entire website to local. And with a regular editor (Sublime, Notepad ++) search in all files for the presence of this link))))

Answer 2

Analyze theme
Rebuild site from clean core and clean plugins from repository

Answer 3

Where is it visible? In the console? Do not forget that your browser may be full of holes! Those. the script is loaded not by the site, but by your browser, a similar effect will be on similar sites)))