Posts have malware links

A friend hasn’t updated their wordpress site, it was hacked and every post points to a malware site.
I got in to the admin area. updated everything I could and removed plugins that can’t be updated.
Installed wordfence.
Wordfence ‘says’: Post contains a suspected malware URL: [post name]
Bad url: http://MalwareSite.life/scripts.js

And there are hundreds of these infected posts.

How do I fix them for him?

Thanks in advance.
Steve