I would look for the source of the problem first. Is there a plugin or theme that all sites share? A common library?
Getting rid of it isn't enough. Unless you identify the source of the bad code and eliminate it, you will continue to be reinfected.