WordPress Malware Cleanup Needed

My site has picked up malware somewhere in the WordPress installation, but I’m not sure which files, pages, or database tables are affected. I also don’t know if any security plugin is currently active. I need someone who can:

• Run a full scan of the core files, themes, plugins, and database to pinpoint every malicious fragment
• Remove all infections safely without breaking existing functionality or design
• Patch vulnerabilities, update outdated components, and set the correct file permissions
• Install and configure an appropriate security plugin, then show me how to monitor it
• Provide a brief report of what was found, what was cleaned, and the steps taken to harden the site

Once the job is done the site must load cleanly with no hidden redirects or suspicious code, and it should pass a fresh security scan.

There is a WP File Manager plugin that keeps popping up