The steps to fix your site are the same regardless of what web software you are using (Drupal, WordPress, Joomla, Backdrop, etc).
Below is a description of the steps. You accomplish them using either a graphical Secure FTP program or secure shell. Below each step is a sample command to run if you choose to operate via a secure shell command line and you are working with a WordPress site.
rsync -a ~/web ~/files/web.bak
cd web
wp sql dump
mv *.sql ~/files/web.bak/
# Check the names of your active plugins
wp plugin list --status=active
# Check the names of your active theme
wp theme list --status=active
rm -rf ~/web/*
rm -rf ~/web/.*
sites/default/settings.php, in WordPress wp-settings.php), your files directory (in Drupal - sites/default/files, in WordPress wp-content/uploads), and your custom theme directory. We will work on these files later.mkdir ~/files/holding
rsync -a ~/files/web.bak/wp-config.php ~/files/holding/
rsync -a ~/files/web.bak/wp-content/uploads ~/files/holding/
rsync ~/files/web.bak/.htaccess ~/files/holding
# Change YOUR-CUSTOM-THEME to the name of your custom theme folder (if any)
rsync -a ~/files/web.bak/wp-content/themes/YOUR-CUSTOM-THEME ~/files/holding/
nano ~/files/holding/wp-config.php
wp core download --path=$HOME/web
diff -u ~/web/wp-config-sample.php ~/files/holding/wp-config.php
# If it looks ok...
cp ~/files/holding/wp-config.php ~/web
less ~/files/holding/.htaccess
# If it looks ok
cp ~/files/holding/.htaccess ~/web/
# Re-install fresh copies
cd ~/web
wp theme install <themename>
wp plugin install <pluginname>
find ~/files/holding/uploads -name '*.php'
# To delete them:
find ~/files/holding/uploads -name '*.php' -delete
# When satisfied
mv ~/files/holding/uploads ~/web/wp-content/
# No good example for comparing themes. To restore:
mv ~/files/holding/THEME-NAME ~/web/wp-content/themes/
cd ~/web
wp --skip-plugins --skip-themes sql cli
SELECT * FROM wp_posts WHERE post_content LIKE '%<?php%' OR post_content LIKE '%<script%';
# Note: This query can produce false positives - perfectly innocent posts that happen to have php or javascript in them.
SELECT * FROM wp_options WHERE option_value LIKE '%<?php%' OR option_value LIKE '%<script%';
wp --skip-plugins --skip-themes user list
wp --skip-plugins --skip-themes user reset-password --skip-email user1 user2 etc
When you are done, make a backup copy of your new web directory. If you are infected again - it will be useful to compare your fresh web directory with the compromised one - it could provide clues for how the attacker got in.