rngdmstr on "WordPress Hacked, residule malicious code?"

If you can SSH into the server, do a 'grep' command for shinohei and that will let you know all of the files that contain that code ;)

From there, it's as simple as deleting that string that you mentioned and saving overtop.