thank you Ben for reply
yes that is the same malware. i did try to fight with Wordfence Security plugin, it did menage to find all files that are infected but it didnt menage to fix it, it didnt help that this plugin even have database with “original” files for wordpress nad plugins.
my problem is fixed now, with help of third party services online. he hire them and they menage to fix it.
the problem was even bigger then we know, because they have told us that this malware have expanded to other websites on this host.
overall i dont know what to say to anyone else that have problem with this malware, even u do what Ben had done and ty to fix it, or hire third party services to do job.
