How to remove malware from WordPress, step by step
The reliable way to remove malware from WordPress is to replace rather than repair: back up the infected site as evidence, lock the attacker out by changing every password, replace WordPress core, plugins and themes with fresh copies, clean the database and uploads by hand, then close the hole they came in through. Scanning tells you where to look; replacing clean files is what actually removes the malware.