Setup wizard appears instead of site

A friend/client’s site has suddenly started displaying the WP Setup Wizard when you go to the site URL. This also appears if you try <site>/wp-admin or <site>/wp-login or <site>/login – all redirect to the wizard script <site>/wp-admin/install.php. Thus she and I can’t get into the WP Dashboard at all. Looking at the File Manager in the hosting account cpanel there are no obvious dodgy files.

I’ve not cited her URL as, with the setup wizard appearing, the site is extremely vulnerable. The site’s been going for many years and has been hacked a few times, which I’ve fixed then installed Wordfence which has up to now kept hackbots out.

Could someone suggest an initial diagnosis? Is there a manual tweak in a PHP script or DB table (I have FTP and MySQL access) which can unset the wizard?

I know that the standard response is: you’ve been hacked, so you need to wipe the site and rebuild from scratch. That’s not an option.

In the meantime, I’ve told her to report the problem to the hosting company and get them to take the site offline toot sweet.

I did try to search for the problem in the Codex but couldn’t find a suitable search string, and anything with ‘setup wizard’ in picks up a bundle of hits.