I have indeed installed this plugin but it doesn’t really show which files are currently infected. It only tells postfixadmin… that’s something from the template. So I think the template newspaper is the cause. I am going to replace this with another template and hope that the malware will also disappear.