Sorry if I sound snippy on this, but I have been working on it for weeks now, with no definite answers and no leads to allow me to fix it.
Also cannot be duplicated. There are scripts I run that removes it, but then someone gets it again a few days later.
Can you tell me what antivirus is picking it up? Is it Google safe browsing?
They take days to remove warnings, long after the issue is gone.
But for the first time today I was given some specific code that was injected, and the file it was in...so now I have something concrete to work with.
It is already removed (again) but Google will take a day or 2 to remove the warning.
Getting there...they won't win.