Website got spoofed/hacked, disavow links and remove URLs??

Hello all,

So one of my clients' sites got spoofed. Basically, this is when someone copies your site, including the URLs, and redirects people in the SERPs to their site.

I believe I removed the source of the hack, but Google WMT is still reading that these trash links (i.e., http://Client's URL/viagra-in-canada) still exist on the site. When I try to click on the link within WMT, I get a not found error (which leads me to believe the hack is gone). Should I "remove" these URLs still within WMT?

Also, There are a ton of trash backlinks due to the hack that are pointing to these fake URLs as well as real URLs. Should I disavow all these links or will it not matter?

Thank you all

If the links are gone (i.e. 404), there's no need to disavow them. GWT will stop displaying those links to your site once it's updated. But even if it does, your rankings won't be affected by those links as long Google has recrawled them and discovered that they no longer exist.