In general, the best place to look is in your theme folders, specifically the main theme and in the index.php file. Then the footer and header files.

Also, check your modified dates and start with the most recently modified. Especially if there are several that were all modified around the same date/time.

I've seen, and had to fix, this problem several times on people's servers. The false data is normally loaded via a script inserted into the php files of the template.

First, you should definitely read over the Wordpress FAQ for dealing with a hacked site.

Common entry points for gaining the "access" required to pull the injection off are outdated themes and/or plugins. It's best to run production servers with only the one active theme on the server, as well as removing unused plugins and replacing outdated active plugins.

There are a few scripts out there that you can upload to your server to help you find infected files so you can replace, clean or delete them. (Links listed below)

Again, try looking at file modified dates and check out ones you haven't modified/installed recently yet have a recent date on the.


Look for Bad Guys : I've used this one. It takes a bunch of configuration to root out all the false positives ... but it can at least help you get a general idea of which files to check out.
Wordfence offers the ability to scan your files with their free plugin, I can't personally endorse it though, since I haven't used it myself.
https://www.wordfence.com/docs/how-to-clean-a-hacked-wordpress-site-using-wordfence/
Sucuri is linked on the Wordpress forums frequently and they have a plugin for scanning as well, but once again... haven't personally used it. But I'm a hands-on kind of person.


Tips for finding SPAM links injected into the_content
I have this issue where I need a CPT to have several layout options and use templates. Originally, WP does not support templates for custom posts, however I know its possible to do it manually via Meta boxes custom data.

This is the snippet of code I have in my functions, which enables possibility to choose template and save it. It works fine - adds data to db and saves/updates the template. My issue is in the last part, where I try to redirect the theme to correct template and some-why it does not work. 



 // --------Add actions
 add_action('add_meta_boxes', 'custom_template_add_custom_box');

 /* Do something with the data entered */
 add_action('save_post', 'custom_template_save_postdata');


 // --------Add functions
 /* Adds a box to the main column on the Post and Page edit screens */
 function custom_template_add_custom_box() {
     add_meta_box( 'custom-post-type-choice', 'Choose custom template', 'custom_template_inner_box', 'campaign', 'side' );
 }

 /* Prints the box content */
 function custom_template_inner_box( $post ) {

     // Use nonce for verification
     wp_nonce_field( plugin_basename(__FILE__), 'custom_template_noncename' );

     if ( 0 != count( get_page_templates() ) ) {
         $page_template = get_post_meta($post-&gt;ID, '_wp_page_template', TRUE); ?&gt;
     &lt;p&gt;&lt;strong&gt;&lt;?php _e('Template') ?&gt;&lt;/strong&gt;&lt;/p&gt;
     &lt;label class="screen-reader-text" for="page_template"&gt;&lt;?php _e('Page Template') ?&gt;&lt;/label&gt;
     &lt;select name="page_template" id="page_template"&gt;
         &lt;option value='default'&gt;&lt;?php _e('Default Template'); ?&gt;&lt;/option&gt;
         &lt;?php page_template_dropdown($page_template); ?&gt;
     &lt;/select&gt;
 &lt;?php }
 }

 /* When the post is saved, saves our custom data */
 function custom_template_save_postdata( $post_id ) {

     // verify this came from the our screen and with proper authorization,
     // because save_post can be triggered at other times

     if ( !isset( $_POST['custom_template_noncename'] ) || !wp_verify_nonce( $_POST['custom_template_noncename'], plugin_basename(__FILE__) ) )
         return $post_id;

     // verify if this is an auto save routine. 
     // If it is our form has not been submitted, so we dont want to do anything
     if ( defined('DOING_AUTOSAVE') &amp;&amp; DOING_AUTOSAVE ) 
         return $post_id;


     // Check permissions
     if ( 'page' == $_POST['post_type'] ) {
         if ( !current_user_can( 'edit_page', $post_id ) )
             return $post_id;
         }
     else {
         if ( !current_user_can( 'edit_post', $post_id ) )
             return $post_id;
     }

     // OK, we're authenticated: we need to find and save the data

     $page_template = $_POST['page_template'];

     if ( !empty($page_template) &amp;&amp; 'campaign' == get_post_type($post_id) ) {
         $page_templates = get_page_templates();
         if ( 'default' != $page_template &amp;&amp; !in_array($page_template, $page_templates) ) {
             if ( $wp_error )
                 return new WP_Error('invalid_page_template', __('The page template is invalid.'));
             else
                 return 0;
         }
         update_post_meta($post_id, '_wp_page_template',  $page_template);
     }
 }

 /* Custom template redirection hook */

 function custom_template_redirect() {
     global $post;

     if ( is_single() &amp;&amp; 'campaign' == get_post_type($post) ) {
         $page_template = get_page_template();
         include($page_template);
         exit;
     }
 }
 add_action("template_redirect", 'custom_template_redirect');


So how can I 'use' the selected template for that page?
