This question already has an answer here:
First of all, I am not a WP superuser. Recently a friend of mine got hacked, by hacked I mean he didn't update his WP for a long time and got malicious code injected which sent spam, so his hoster blocked him. He only has the infected files, which were already checked and cleaned by a developer...by hand. Now I should setup a new server running his code. But I would like to let a tool check the code of the theme at least and DB. I will setup a fresh installation and re-install the plugins, to make sure that these are free of bad code. So what I have is only the hand-cleaned code, so I don't know what injection we had before, so I can't search for the same pattern or anything. I found some tools, which check the WP-Website for bad code, like sucuri - sitecheck, but this is not an option for me. I would like to check the code locally. What do you guys recommend me to do?