Can't get rid of infected file

One of our hosting accounts had their website hacked. It's WordPress. I have to assume the developer did not have proper security features installed. I have Configserver's Exploit Scanner installed on this server and it has been constantly flagging index.php as infected. I tried everything I could think of to get rid of the file. But it spontaneously regenerates. I eventually suspended the account and that stopped all the email alerts from cxs watch. I'd like to get to the bottom of this in case the client still wants to have a website. Has anyone run into anything similar? Any recommendations on a person or company who would be expert at dianosing this type of issue?