wp-config.php modified?

Once hacked there is no real (at least not easy) way to verify that you have removed all traces of the malware. Good malware will leave an hard to detect backdoor, and there is always the question of whether you have actually removed the attack vector.
Therefor the only 100% working way to remove a malware is to revert to a known good backup first, than improve your security.

It seems like your core security failing is to let the webserver to write to your config (and I assume also code) files. This is just going to make it harder for you to avoid being hacked again with the next software bug.