Hi, thanks for reply!
td_010 has tds_custom_javascript and tds_custom_html that will be outputted to theme footer (file: td_wp_booster_functions.php) and when removing that suspicious code from the database (eval(String.fromCharCode…), redirection will stop.
You can’t see the redirection url with naked eye, because it’s “hidden” by using fromCharCode.

I runned search with notepad++ to check any unwanted redirections.

Here is the javascript: https://pastebin.com/GyBezyat
And here is same code “unpacked”: https://pastebin.com/KKcNYHmR

That javascript creates a script element with external src which includes redirections.

I have the same problem. I detected a suspicious javascript in wp_options where option name is td_010 and td_010_settings. Code is stored to tds_custom_javascript and tds_custom_html.

I disabled the output of tds_custom_javascript and tds_custom_html from td-composer plugin (file: legacy/common/wp_booster/td_wp_booster_functions.php). Code still appears in database after about 12 hours of removing it, someone adds code through api/ajax or something.

Suspicious javascript starts like this: eval(String.fromCharCode