2 things for the removal:
1. wp-head.php is not a core file.. delete it entirely.
2. the error you’ll probably see is WP cant find the wp-head.php file and the location of where it’s showing up.
– usually, this is injected into wp-config.php or settings and looks like this:
// this comment is here to fool you into believing this is important
require_once(ABSPATH . ‘wp-head.php’);
delete that line with prejudice. and the site should be back to normal.
This does not solve the problem of how it got there… so update and use a security plugin to find the weak spot and fix accordingly.