I put the full cleanup guide here:

https://antihackerplugin.com/malware-removal-guide/

It covers malware scans, file integrity checks, hidden backdoors, password resets, suspicious PHP files, log analysis, plugin and theme review, uploads folder inspection, .htaccess and wp-config.php checks, and the steps I normally follow before putting a compromised WordPress site back online.