First of all, I am not a WP superuser. Recently a friend of mine got hacked, by hacked I mean he didn't update his WP for a long time and got malicious code injected which sent spam, so his hoster blocked him. He only has the infected files, which were already checked and cleaned by a developer...by hand. Now I should setup a new server running his code. But I would like to let a tool check the code of the theme at least and DB. I will setup a fresh installation and re-install the plugins, to make sure that these are free of bad code. So what I have is only the hand-cleaned code, so I don't know what injection we had before, so I can't search for the same pattern or anything. I found some tools, which check the WP-Website for bad code, like sucuri - sitecheck, but this is not an option for me. I would like to check the code locally. What do you guys recommend me to do?
Well if your concern is about the theme and data stored in the database, I suggest you also start with a "new install" of the theme.
And as far as the DB goes, I've had a similar experience where I took the hacked DB and installed it on my localhost, then exported the
wp_postmeta tables ONLY.
Then I did a clean install (on the hosting server) of WP with a NEW DATABASE as well, and imported the
wp_postmeta tables into my clean DB. Typically when a site gets hacked and the DB is affected, it's the
wp_options table that has problems.