Site Header shows class-wp-rest-comment-meta-fields php code

I am working to repair a hacked site for a friend. The hosting provider scans show the site is now free of malware, however there are lingering problems. first is the the fact that the code for the class-wp-rest-comment-meta-fields.php file shows up at the top of all pages. I haven’t quite been able to figure that out.

I am also unable to access the admin panel. While the provider malware scans come back clean, attempting to access wp-admin yields a redirect and warning that the site is unsafe.

Let’s tackle one thing at a time. can anyone explain why I am get rest api code in my header.

Thanks,
Craig