Adding to my previous comment: Make sure you check the Wordfence "Scan Detailed Activity" section of the scan page in the Wordfence dashboard for a list of potential malicious files. Wordfence will show you most of them. Don't even bother with Sucuri on this.
↧