Can't log in — wp-login.php just refreshes

I’m trying to help a friend out, and this has me baffled.

Her blog (https://400words.com) was hit by a pharma attack and is now marked as having malware. The hack is preventing us from logging into WP, but I got into the DB and removed (I think) all the bad stuff I found.

We still could not log in, so I want ahead and trashed her installation, replacing it with the latest version. This seemed to go just fine, but we still can’t log in. I’ve been googling for hours, but I can’t find anything helpful.

I have scanned the DB (and all the PHP and JS files) for rogue eval and base64 statements, but have found nothing. I have gone through pearsonified’s instructions for recovering from pharma attacks that happened to him, but this one is different. there doesn’t seem to be any cloaking happening, just bad posts and comments.

But who knows — I certainly haven’t been able to figure it out.

I’ve tried all the basics like killing cookies, trying different browsers, etc, and I have read through the “Login Trouble” page in the WP Codex, but the login page still simply refreshes whenever we try to log in.

Help!