Malware Cleanup for WordPress Server

My Linux VPS that hosts several WordPress sites has been compromised and is now serving malicious code. I need a security-minded admin to:

• Performing an initial backup of all data.
• Pinpoint every infected file and process on the server
• Remove all malware without breaking any WordPress functionality
• Patch core, themes, and plugins, then tighten permissions and SSH/FTP settings
• Install and configure a real-time malware scanner and firewall (e.g., ClamAV, Maldet, Fail2ban, or a comparable tool you trust)
• Document each step so I know exactly what was found, how it was removed, and which hardening measures were applied
• Provide brief post-cleanup guidance to help me keep the server clean going forward

The job is complete when the server is malware-free, WordPress sites load normally, and standard scanners report no threats.