My sites on one account all got infected with a Decode_Base64 script that infected many php files, and despite cleaning up a site which took hours, it got re-infected just hours later.
I ended up downloading the wp-content/uploads folder and any other manually updated files using a secure ftp connection.
I also took notes/backups of the themes, plugins, and other customizations which I would need to re-apply.
Then I changed all the account/ftp passwords, manually changed the database/user passwords using phpMyAdmin, to deny access when the sites came back up.
Next I deleted ALL the Wordpress code from ALL the sites and uploaded instead a simple index.html file that said the sites were under maintenance.
I checked the WP-content/uploads folders for anything that was not an image or my own content, especially looking for scripts (which should not be there).
Next, download the latest version of WP, configure it for the existing database with new password, and upload to the server.
Access the site, which will have only Akismet active at this time. Check for and delete anything that should not be there (pages, posts, links etc).
Install a backup plugin to make sure you have backups of the database/folders.
Install the Bulletproof-Security plugin (or similar) which creates locked down .htaccess files for you and tells you how to secure your files/folders. Comply with it's recommendations.
Finally, gradually apply your customizations again.
If you have multiple domains, repeat as necessary.
In my situation, I was actually planning to move to a new host, so having done this, I then saved everything site by site and re-created them on the new host, once I was sure that the rebuilt old version was clean.
Good Luck and I hope this helps.