 <p>It really depends on what you are trying to keep.</p> <p><code>wp-config.php</code> stores your database connection details and a few other settings.</p> <p><code>wp-content</code> is the directory that stores all of your uploads and plugins. Essentially all of your uploaded content.</p> <p>The file and folder shown above are what you would typically want to keep. However, the infection could very well have spread to the php files in there too - so keep that mind!</p> <p>The alternative method is listed below:</p> <p>A good idea would be to follow the manual upgrade process instead</p> <ol> <li>Get the latest WordPress zip (or tar.gz) file.</li> <li>Unpack the zip file that you downloaded.</li> <li>Deactivate plugins.</li> <li>Delete the old wp-includes and wp-admin directories on your web host (through your FTP or shell access).</li> <li>Using FTP or your shell access, upload the new wp-includes and wp-admin directories to your web host, in place of the previously deleted directories.</li> <li>Upload the individual files from the new wp-content folder to your existing wp-content folder, overwriting existing files. Do NOT delete your existing wp-content folder. Do NOT delete any files or folders in your existing wp-content directory (except for the one being overwritten by new files).</li> <li>Upload all new loose files from the root directory of the new version to your existing wordpress root directory.</li> </ol> <p>If you get stuck here - have a look at <a href="https://codex.wordpress.org/Upgrading_WordPress_Extended" rel="nofollow">https://codex.wordpress.org/Upgrading_WordPress_Extended</a></p>