My first step isn't one you must take but I was helped by it. I had a fantastic old style pity party. I cried and railed against the evil hackers (that where probably 13 and smarter then me.) And then I did what I should have done before I started my site. And here is where I would like you to start as well. Learn hacked. The attractive thing about fix wordpress malware scanner and why so many of us recommend because it is easy to learn, it is. Unfortunately, that is also a detriment to the health of our websites. We need to learn how to add a security fence around our site.
There are many ways to pull this off, and a lot involve re-establishing databases and much more and FTPing files, exporting and copying. Some of them are very complicated, so it's important that you select the right one. Then you might want to look into using a plugin for WordPress backups, if you're top article not of the technical persuasion.
Move your wp-config.php file one directory up from the WordPress root. WordPress will look for it if it cannot be found in the main directory. Also, nobody else will have the ability to read the file unless they have FTP or SSH Full Report access to your server.
You can extend the plugin features with premium plugins such as: Amazon S3 plugin, Members only plugin, DropShop etc.. I think this plugin is a fantastic option and you can use it for free.
Implementing all of the above will take less than an hour to finish, while making site web your WordPress site considerably more resistant to intrusions. Over 1 million WordPress sites were last year, mainly due to preventable safety gaps. Have yourself prepared and you are likely to be on the safe side.