UPDATE wp_posts set post_content=REPLACE(post_content,'<script src="http://uoauer.com/si"></script>','<!--Cleaned-->') WHERE  LOCATE('<script src="http://uoauer.com/si"></script>',post_content)

Just change the script tag to whatever your malware is injecting.

Clean Wordpress Posts of MALWARE

MySQL