Let me shoot a few scare tactics your way since scare tactics seem to be what drives some people to take fix wordpress malware fix a bit more seriously, or at the very least start considering the issue.
I protect an access to important files on the site's server by placing an index.html file in the particular directory, that hides the files from public view.
You need to create a user with administrator rights, before you can delete the default admin account. To do this go to your WordPress Dashboard and click on User -> Create New User. Then enter all of the information you need to enter.
What if you go to WP-Content/plugins, can you see that folder? view publisher site If so, upload that blank Index.html file into that folder as well so people can't view what plugins you might have. Because even if your version of WordPress is up to date, if you are using a plugin or an old plugin using a security hole, someone can use this to get access.
Oh . And by the way, I talked about plugins. Make sure it's a safe one, when you get a new plugin. Do not install any plugin because the owner is saying on his website that plugin will allow you to her response do this or that. Maybe use maybe, or a test blog to look at the plugin get a software engineer to analyze it carefully. This way is not a threat see here for your organization or you.