There was still a trace of malware somewhere so I decided to take extreme measures. I deleted all WordPress files, deleted the database, and started again with a ten day old Vaultpress backup. Everything is clean again according to scans and I’m filling in the blanks from Day One copies. Phew!