Hello Mickey, thanks again for all your help and I'd just like to tell you where I am.
I've copied all the files via FTP. And exported the DB with PHPMyAdmin (this was a new version of PHPMyAdmin so I'm not sure if I did this right but I have an SQL file.
As a matter of interest I'm not sure if it was the TimThumb vulnerability as I've checked the WP files and they are riddled with eval code and 1px by 1px iframes pointing to gogofly dot cjb dot net which is a "top domain distributing malware" according to Sucuri. And there wasn't the tell-tale signs in the config.php of TimThumb vulnerability. But it may have been a combination of things. The passwords weren't very good and it was WP 3.2.1.
Anyway, I've deleted all the files and the DB and created a new WP clean install (this was necessary as the person has lost the WP passwords and the email address that originally created it).
So what I'd like to do now is to import the information in the old DB into the new DB as it has all old text, pages and image paths.
How do you do this? I have tried importing it into the new DB via the Import function in PHPMyAdmin and it just stops WP working - you get a white screen of death. I presume because the usernames and passwords are different between the old and new DBs?
I've googled around about this but I haven't come up with anything - I will keep at it though.