Website virus removal

Hello, I received some spam codes through the form on the website (the site is on ocStore) and after that, I received the following email from the hosting:

Greetings.

We inform you that a mass automated mailing of emails from the server has been recorded on your site.
According to the server logs, it was established that the sending was carried out through a PHP script from the site directory (/var/www/sexygold/). This is not standard operation of the site (for example, feedback forms), but is characteristic of third-party or compromised scripts that are used for sending spam.
In particular, a file ai-bolit.php was found on the site, which is intended for scanning the site but was left publicly accessible. Because of this, it could have been used by third parties to send emails from your server.

In this regard:
the sending of mail from the server has been temporarily restricted to avoid the IP being added to spam databases;
this is a standard protective measure to prevent the blocking of the server and mail services.

We recommend:
Remove third-party files (in particular ai-bolit.php, adminer, and others, if they are not in use).
Conduct a full check of the site for malicious code.
Update the CMS, themes, and modules to the latest versions.
Change all access credentials (FTP, SSH, database, admin panel).

After eliminating the cause, please inform us, and we will check the site and be able to restore the ability to send mail.

We need a person who will bring this in order)