repair wordpress site (hacked)

The wordpress installation has been fine against hacks for year but somehow some changes have caused a script to send unsolicited emails (SPAM)

i.e.
https://websitename[.]com/news/index.php
hxxps://websitename[.]com/news/?70af594262e1a8ca1e8ea9fcbcb6dea2

looking for someone to fix this script within the wordpress installation

thanks