Ouch. Regretfully, if you don't have backups you are not in for a fun time. The problem with security plugins is that they usually don't detect every issue. They are good to get to a decent starting place, and the checksum they run on core is great, but they will tend to miss issues with themes and custom code that is infected. The best way imo to fix an infection is to find the culprit and find WHEN it infected the system. You can do this by finding a single file that you know is bad and look at the timestamp of the file. You can then run a check on all the files that were changed around the time of the infection. Usually this is rock solid, unless the infection period was spread over a long period. I've seen infections that spread every time admin was accessed, re-transmitting done by plugins. I've also seen plugins mask themselves from both securi and wordfence, as regretfully malware operates at the same level as them. It can be a shit show and occasionally your only option is to copy the assets and db and reload from scratch -- and even then you can run into an issue where code can be lurking in the html in the db.