Website hacked

My site was hacked. I finally got rid of or fixed all modified files but it comes back. I think there is a culprit in the cron entries. If I turn ON all crons, the malware gets re-installed. If I turn OFF all crons, the malware does not re-appear so, I suspect the issue is in one of the cron entries. How can I view the actual code being executed in each cron?