Wp vcd known malware

you may want to implement some (if not all) of the recommended security measures.

what about just using wordfence and expect same security?

Use worfence and hardened your installation.

Triple check you’ve carried out all the advice from this guide.

If you’re unable to clean your site(s) successfully, there are reputable organizations that can clean your sites for you. Sucuri and Wordfence are a couple.

Use a good host.