I think hacker used !c999Shell v. 1.0 pre-release build #16! tools to hacked site they change index.php page and place there hacked index.php page.
I followed all instruction like all the folder permission is set to 755 and all file permission is set to 644 and permission of wp-config.php is set to 750.