Well Doh!
Looks like I had fixed it following the suggestions you made elsewhere, then I broke it in an over zealous attempt to clear out the hack.
The site is up, all be it intermittently. I have changed all the passwords, except the SQL one that will not change. The hosting company are looking in to that (their support is terrible).
Time for me to carefully read all that hardening info.
Thanks for the help