Use the below points to remove malware from your WordPress Site
1 - Replace WordPress core Files according to the current version of your site. Same do with free plugin and themes.
2 - Install a plugin to scan your site. And clean the files appear in the scan report.
3 - Check the cron jobs and delete all unnecessary.
4 - Scan the database for malware script. This type of script hardly appear in the scan report.
Contact me of you need professional assistance. Thanks