If there was an easy magic do-everything fix for you, we'd give it to you so you could get it fixed and stop insulting us.

It's not "opinion". I've dealt with this before. These kind of malware infections are designed to be difficult to detect and remove. When I ran into a situation like this where the customer had no backups, I wrestled with it for days, but removing the bad parts kept breaking the pages, and it made efforts to put itself back that made everything worse than when I started. I eventually had to track down the original .zip files for the software -- thank goodness the internet is huge, some data-packrat somewhere or other is likely to have anything -- replace everything with a .php extension, and remove everything else newer than 90 days old.

Then afterwards, I secured the permissions properly so it wouldn't happen again...