Greetings!

I’m sorry about this, having a website compromised can be quite a frustrating thing to deal with. The first thing that you need to know is that you absolutely will need to dive into the server to fix this, there will be no substitute for this. This means that you either need to be familiar with Linux or you need to be willing/able to get familiar with it. The one thing I will not have handy is a tutorial that will certainly bridge the gap between current knowledge and the knowledge necessary to solve this problem. I do not know where you sit currently on that line, so I make no assumptions.

When dealing with a compromised website, I really enjoy the accepted and most upvoted answer here:

https://serverfault.com/questions/218005/how-do-i-deal-with-a-compromised-server

Additionally, Wordpress has some great documentation for the situation:

https://codex.wordpress.org/FAQ_My_site_was_hacked

I’ve also written up my recommendation in the past, for dealing with compromised Wordpress sites. I will paste it here for your benefit:

You’ll have to go through your files one by one to find the malicious code. The proper way to deal with this is to take one of the compromised files and run the command “stat” against it, like “stat filename”, to find the modify time. Take that modify time and compare the timestamp to the website’s access logs. You should find a “POST” request to another file which generated that malicious file. You may have to then take that file and do the same, until you are led back to the original compromise. If you’ve traced it back as far as you can and you are still not sure, take the IP address from the oldest access log entry that is clearly a malicious POST request, then run that IP through the logs. This method has always had a 100% success rate for me in identifying the root cause of a compromise. Once you identify the root cause, consider replacing any theme or plugin that may be responsible with fresh code. Make sure that the vulnerability is removed in the version you upload.

I hope that this helps!

Jarland