Reinstall SimplePie and wp-admin/css

Which CSS? Your theme’s? Just download a fresh copy of your theme to your local computer, then upload the CSS to Server.

Same goes for SimplePie, get a fresh WP download, extract the needed files and upload to server. Be sure to download the version you are running on your server. You can wholesale delete and replace wp-includes and wp-admin folders entirely, there’s nothing special about them unique to your installation.

Right, wp-config.php is unique to your installation, though the unique portions should be able to be re-created starting with wp-config-sample.php and entering your DB connection parameters. You can create new keys and salts, the only side effect is any currently logged in users will need to log in again for their next page request, as will those that checked the Remember Me box – it won’t remember.

As for files you list in wp-config, they appear to be replaceable, but I couldn’t say with certainty. Download the current files and save as backups just in case.

I should mention that hackers are very clever at hiding back door code, it can be quite difficult to find such code. The only certain way to eliminate back doors is to completely wipe the server and restore from a known clean backup. Still, many people have successfully recovered from hacks without going to that extreme. Do what you feel you need to do, but keep this in mind. Good luck!

You’re welcome! That’s good news.

FWIW, I really doubt the plugins you mention have vulnerabilities as downloaded from the repository. More likely the versions on your server were altered by the hack and had vulnerabilities (aka back doors) introduced.