Krasi

You could try this query, it will select all draft posts that are “uncategorized”, its hard to say exactly what query will match them when I can’t see how they are injected, if they are not set as drafts then you can try to modify the query a bit:

SELECT * FROM wp_posts p LEFT OUTER JOIN wp_term_relationships r ON r.object_id = p.ID LEFT OUTER JOIN wp_terms t ON t.term_id = r.term_taxonomy_id WHERE p.post_status = 'draft' AND p.post_type = 'post' AND t.slug = 'uncategorized'

If you can provide a screen shot from phpmyadmin we might be able to help more.

Replacing the core files will get rid of the malware unless its in the wp-content directory or has its own directory which wont be removed when you replace the core files, re-installing will fix it but then you have to start all over, there could also be malware in the database so even if you replace all the files and just restore the database with your posts there could still be malware inside causing the website to get re-infected.

Sounds like your website still had malware inside, I would also check for any cron jobs, its possible that a cron job was left behind and keep running in order to re-infect the website, malware can write the backdoor in /var/tmp and use a cron to run it, even if you replace all the files for the website it will keep re-infecting it.

Here is more info:
https://blog.sucuri.net/2014/01/the-hidden-backdoors-to-the-city-of-cron.html