Thanks for reaching out.
If you have access to the database you should be able to turn them off. There are a few ‘needsNewTour_*’ (e.g. needsNewTour_scan) fields in the wp_wfconfig table that you should be able to set to 0 which should turn the tours off.
The larger issue is probably that whatever damage the hack caused has broken something in the adm,in. Examining the browser console will likely help figure out what is broken though you may just be fixing the symptom and not the actual problem.
Once you do get the plugin running you can use Wordfence to clean your site. There is a guide available here that can help walk you through the process.
Make sure and get all your plugins and themes updated and update WordPress core too. If you are on an older branch (WordPress 4.x etc) because you wanted to wait before installing the latest version because of Gutenberg or a custom theme compatibility you still need the latest update in that version. Those can be found here:
https://www.ads-software.com/download/releases/
WordPress sometimes even patches their older releases if a vulnerability that was found so make sure to update your version if needed.
As a rule, any time I think someone’s site has been compromised I also tell them to update their passwords for their hosting control panel, FTP, WordPress admin users, and database.
Additionally you might find the WordPress Malware Removal section in our free Learning Center helpful. https://www.wordfence.com/learn/
If you are unable to clean this on your own there are paid services that will do it for you. Wordfence offers such a service for this. Regardless if you choose to clean it yourself or let someone else do so, we recommend that you make a full backup of the site beforehand.
Tim
