Once hacked there is no real (at least not easy) way to verify that you have removed all traces of the malware. Good malware will leave an hard to detect backdoor, and there is always the question of whether you have actually removed the attack vector.
Therefor the only 100% working way to remove a malware is to revert to a known good backup first, than improve your security.
It seems like your core security failing is to let the webserver to write to your config (and I assume also code) files. This is just going to make it harder for you to avoid being hacked again with the next software bug.
Related Posts:
- Verifying that I have fully removed a WordPress hack?
- If a hacker changed the blog_charset to UTF-7 does that make WordPress vulnerable to further attacks?
- Tips for finding SPAM links injected into the_content
- What should I do about hacked server?
- How can I find security hole in my wordpress site?
- How to prevent bot or someone to modify any file automatically?
- Suspicious Files
- How to prevent wp-login brute force attack from thousand of different IP? [duplicate]
- Malware script in database post table only? [closed]
- Verifying that I have fully removed a WordPress hack?
- How can I safely hide the fact that my website runs on WordPress? [closed]
- My WordPress Websites are always under attack
- How to find exploited wordpress plugin [closed]
- Any known bugs that could cause disappearance of the wp_users table?
- On new server, site got hacked, permissions a bit strange? Please help
- Replace domain in database
- Remove hacked code – out of ideas! [closed]
- WordPress Database Re-installed (Hacked)
- Verifying that I have fully removed a WordPress hack?
- Could a user account with a stolen password compromised entire WP site?
- how to find the way they hacked my WP site
- How to stop repeated hack on header.php of custom theme? [closed]
- Is my WP site being hacked?
- Should WordPress Add Options to Enhance Security or Leave it to plugin developers? [closed]
- WordPress Hacks/Defacing [closed]
- What’s the best approach for generating a new API key?
- Simplest two-way encryption using PHP
- How does the SQL injection from the “Bobby Tables” XKCD comic work?
- how fix “this certificate cannot be verified up to a trusted certification authority”
- How can bcrypt have built-in salts?
- Getting a List of Currently Available Roles on a WordPress Site?
- What’s the easiest way to stop WP from ever logging me out
- How safe / sanitized is wp_insert_posts()?
- From a security standpoint, should bloginfo() or get_bloginfo() be escaped?
- Why are passwords exportable as plain text in WordPress?
- What’s the difference between esc_* functions?
- Is there a way to force ssl on certain pages
- What is the purpose of having a token in cookies?
- How to remove “Connection Information” requirement on localhost install of WP on MACOSX
- How is password strength calculated?
- Regular security checks – what steps should be included?
- What are the pros and cons of using a custom front-end to retrieve content from a WordPress back-end
- Do Cookies Need to be Sanatized Before Being Saved?
- Disable external access to REST API Endpoint
- What is the wp-includes/certificates/ca-bundle.crt used for?
- Do you need to escape hard coded plain text?
- Encrypt emails?
- WordPress salts set in config and database
- Disallow file edit not preventing plugin install
- How to secure WordPress XMLRPC?
- Websites defaced by uploading script using theme editor
- Does WP show me if I’m logged in from multiple locations?
- Has anyone experience w/ WordPress (MultiSite) hidden users (possibly hacked)?
- HTTP Security Headers in wp-config
- WordPress Malware Problem help! [duplicate]
- Restrictive File Permissions
- Why are xmlrpc.php and wp-cron.php being called so often?
- Using esc_html with HTML purifier and CSSTidy: Overkill?
- wordfence scan warning on W3 Total Cache [closed]
- vs WordPress Security
- esc_html__ security : what for in this example?
- Securing wp-config leads to sensitive information leak on wp-settings
- What’s the point of forbidding access to wp-config.php?
- wp-json and what data does it give away?
- Is is necessary to use security plugin for wordpress? [closed]
- neccessary?
- wp-config.php being written by attacker
- my wordpress website is suspended [closed]
- iTheme Security always lockout my account [closed]
- Is it sensible to worry about sanitizing admin input in plugin custom CSS?
- WordPress Front end Form – Enable to Submit PHP Codes
- Is it safe to hand over the admin rights?
- Is it safe use wp_editor in public contact form
- Is WordPress MultiSite secure & how much can it scale? [closed]
- How safe is current_user_can()?
- Is it safe to give wordpress directories ownership to www-data?
- Troll the hackers by redirecting them
- Do we need to escape data that we receive from theme options?
- Why does WordPress change a file’s permissions?
- Side effects of disallowing *.php requests in production environment?
- Outgoing new connection to linked Websites – why?
- My Site keeps crashing due to the wp-confg file being deleted
- Someone keeps changing my SITEURL (mysql injection or xss?) [closed]
- Who updates the wp-admin/core file?
- Does this code indicate an exploit?
- What highest security brake with wordpress and static files?
- Spam in WordPress root folder
- How can I backup my site if it gets hacked?
- Cannot access wp admin of WordPress website (security plugin issue) [closed]
- Why are the latest visits to my website originating from my own website?
- How do I hide WordPress users from security scanning?
- Background Updates Not Happening
- wp-config.php file and code injection
- FORCE_SSL_ADMIN affecting subdomains
- What is the best security $_POST method?
- suspicious boolean.php file in wp web root [closed]
- My WP site and password was hacked, what to do? [closed]
- Our security auditor is an idiot. How do I give him the information he wants?
- I am under DDoS. What can I do?
- SSH keypair generation: RSA or DSA?