XCodeGhost is from hacked apps, where the development code was actually hacked, and is iPhone/iOS specific. The fix is to remove the infected/bad apps and reinstall them.
1. Reset to factory settings *or* remove all infected apps. Note: the reset to factory defaults is overkill, but it's the quickest way to wipe the phone. If the customer doesn't want to reset, that's okay, just make sure to remove the infected apps.
2. Reinstall apps from the app store or directly from the app vendor, *not from backup.*
For a list of infected apps see:
XCodeGhost iOS malware: The list of affected apps and what you should do
Make sure the customer knows they can still use the same app, but they should get a repaired version from the app store.
Note that iCloud will probably keep the infected apps backed up, even if the user installs the app directly from the store, so make sure to remove *all* backed up versions of the app or the user may get turned in again.