How to Search a WordPress Blog for a Virus

1. Use the AntiVirus plugin found at WordPress.org. The AntiVirus plugin allows for manual testing, as well as a white list --- you can place any files marked as suspicious onto the white list if you know they're free of viruses, so that they're not tested in the future. The AntiVirus plugin also runs automatic daily checks.
2. Download Theme Authenticity Checker (TAC) from WordPress.org. This plugin is designed to look specifically at the theme you're using on your WordPress blog and detect any signs of malicious code. After malicious code is detected, you can either try to contact the theme's author, or uninstall your theme and find a new one.

3. Use the Exploit Scanner from WordPress.org. The Exploit Scanner works by scanning all of your files, including comments and posts for signs that someone has found an exploit and is able to access your WordPress. Exploits can be caused by a virus or a hacker attack. One of the downsides is that Exploit Scanner doesn't remove anything --- that's left for you to do.