Virus

Our developers have located an extremely obscure virus injected into our website and seem to think it has come through the theme.

The code is injected just after the body tag within the enfold-child header file.
​
In almost all browsers this is perfectly fine. The offending code is not present and not causing concerns, however in older versions of IE (So far they have discovered the bug in IE7 and IE8, and confirmed it is not present in IE EDGE) a very malicious code appears and attempts to install viruses and other unwanted material on the client machine.

Additionally the code only appears to show up after clearing the cache and cookies of the browser before attempting to load the url.

Link displays this error very clearly.
​
The code itself appears to change each time the page loads, making the methods I would usually use to locate the offending code ineffective.

Additionally, I have attempted, with our limited PHP knowledge, to dump out the contents of the GTM plugin code to ensure it is not the source of the infection and it appears to be clean.

Our developer is currently working on the theory that the body content is being buffered, and then modified before being rendered to the browser, allowing it to check for IE