Virus on wordpress?

Question

Malware

There is a site mat-i-detya.ru
A Chinese search engine appeared on it, at the very top. I deleted all the files that could be infected, I searched for such files through the totalcommander.
Nothing has changed, in the source code you can see that the script is being loaded there. I checked every file, database, nowhere.
What is strange is not in 1 css there are no those tags that go in the source code, that is, the search engine page just sank somewhere. But where can I find this download code?

Answer 1

Look in the php files for lines eval(base64_decode
. These are the encoded tags of the malware

Answer 2

once the virus was in jpg files. open with notepad - and there is a script

Answer 3

Does the "TAC" plugin https://wordpress.org/plugins/tac/ find anything?

Answer 4

be sure to install the wordpress file monitor plus plugin - you will be aware of any movements in the file system

Answer 5

See related questions : 1 and 2 .