How to use Nginx to lock all files that have a specific name?

Question

My server has been infested by a backdoor that has a specific name for the files. I’m removing the files, but the server is a little long and it takes to delete everything that was found. Until then, someone can use this backdoor to infest everything again.

Is there any way I can configure Nginx to lock all files containing the name config.bak.php?

I tried the following:

server {
  ...
  location ~ \.bak\.php$ {
    deny all;
  }

  location ~ config\.bak\.php$ {
    deny all;
  }

  location ~* config\.bak\.php$ {
    deny all;
  }
}

But none of the alternatives had any effect when I tried to access these files.