4.2.1 was released to fix cross scripting
to figure out what files were/are infected zip up the site and run it via Virustotal (if under 200mb)
I would break the site down into smaller and smaller gtoups of files until I figured out the offending code.
The first thing you need to do is secure your hosting change your passwords, use lastpass to generate secure 16 character complex passwords.
If you use cPanel and have more than one site you are vulnerable from one site (under your login) affecting another. One of the reasosn I do not use cPanel).
I would install new wordpress on a new DB, then import the site bit by bit after I have verified all files.
I would not re-import the user, options and user meta files from old site.
Remember that once a hacker has access to your FTP they can get access to your files which themselves give access to your DB.
I know you are worried about this but doing this gives you technical ability to take ownership of problems.
I would get wordfence, the free version is probably enough, although the paid version does have the ability to prevent access to the admin page from specific countries. I have found that excluding China, Russia, Ukraine and Romania cut 99% of attempted hacks. Then I decided to only authorize actual countries I wanted to have access to the Admin.
From what you describe it seems that they managed to put a file on the public facing site, then they ran that URL to test it, it probably infects users and chances are they would spam people to visit that link which would infect their PC
For SEO use Yoast, better IMO anyway!.
