Make sure you delete your whole /install folder as that is how he hacked your site!

And, as Richie says, you should .htaccess protect your /admincp. Make sure that is a unique username/password (don't use the same as your /admincp login like some admins do as that will NOT make it secure if they have your admin login details!). Actually, read all that Richie wrote as it is very good advice.

Thanks Lynne! That is high praise coming from you and I'll take it. :D

Thanks again. We restored to a week prior to the hack so I can't check logs. I did delete the install folder completely, it positively was not there at the time of hack as my last 2 local backups show. I will do everything else you said as well. What is the admincp firewall and how do I .htaccess protect my /admincp?

You can password protect your ACP with this mod, https://vborg.vbsupport.ru/showthread.php?t=312555