Virus on the site. Where are the problems?

Question

Google

Site kubelets.by. Google swears, writes that a malicious site found a js script in the code, which sometimes redirects to another site, deleted it. and everything seems to be clean, but Google still swears. + A couple of days later the script appeared again. how did they do it: hacked the host, brought the script in a new way? or is something bad sitting somewhere that creates this script itself? I ran it with antiviruses, it doesn’t find anything, only that Google considers it bad. who has any thoughts?

Answer 1

Only visual analysis. Of course, you can try to look for crazy code constructs like

.""
"".
."".

which often occur after obfuscation.
Well, according to the keywords of the eval type functions.

Answer 2

Is there something bad somewhere?

WordPress plugins

Answer 3

Not cleaned up, look more carefully.
Did you change all passwords? It is better to work with the site through sFTP.