Removing Malware Quickly

I have a couple of sites that have been hacked, I have identified the code that has been inserted into the PHP files, the only problem is that the code goes right through every PHP file , if I replace the theme the new theme also has the code in the file. It would take me days to edit each file.

I guess whoever hacked the site didn’t add code to each file on a one by one basis? I assume they added to one file that would populate throughout the site , my question is what file would effect all the others, if I add or remove code from one file will it automatically be in the others?

Any advice would be most welcome.