Password change

config file was hacked, what else needs to be changed so the site work?

You need to start working your way through these resources:

How to clean and fix hacked WP blog:
https://codex.www.ads-software.com/FAQ_My_site_was_hacked
https://www.ads-software.com/support/topic/268083#post-1065779
https://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/
https://ottopress.com/2009/hacked-wordpress-backdoors/
https://www.jtpratt.com/how-to-fix-a-hacked-wordpress-blog/
https://sakinshrestha.com/wordpress/fix-if-your-wordpress-site-is-hacked/
https://www.wpbeginner.com/wp-tutorials/how-to-find-a-backdoor-in-a-hacked-wordpress-site-and-fix-it/

Harden your WP installation: https://codex.www.ads-software.com/Hardening_WordPress

Additional Resources:
https://sitecheck.sucuri.net/scanner/
https://www.unmaskparasites.com/
https://blog.sucuri.net/2012/03/wordpress-understanding-its-true-vulnerability.html

My site is fine and clean. I just need to know where else changes need to be made after changing db pass, not anything about hacking.

Changing a Database Users password will affect the applications using this Database user.

That statement applies to any application on your web space that uses a database. If you change a database (any database, not just wordpress) users password, you must also change any application configuration files where that password is being used.

As far as WordPress goes, the only place your database user password is used is in wp-config.php. If you change the wordpress database users password on your database, you must also change it in the wp-config.php file.

Thank you ?? So it’s easier than I thought. Whew!

You’re welcome.