If you have a basic idea of how WordPress works, you can simply follow these steps to clean your site.

1. Go to the folder/document root of the site. For the main domain, it's public_html and for the addon, there are separate folders.

2. keep wp-content and wp-config.php and delete everything else. Copy the database name, username, password, and table prefix from the wp-config.php file and delete that file too.

3. download WordPress from wordpress.org and upload here and extract it. Data will be inside the WordPress folder, move it out to the site's main folder.

4. Open the domain in the browser there will be a WordPress installation page enter your database name, username, password, and table prefix that you copied from the wp-config.php file

5. then login to the dashboard and go to permalinks and click the save button.

6. Then scan with WordFence Plugin and at the end click the buttons: delete all deletable files and repair all repairable files and scan again until the file changes and the malware is not fixed.