[Firyou]

There are a lot of ways someone could have gained access to those files and compromised it. If you have the install folder in your vb root, I suggest removing ASAP. One of the most known 0 day exploits is through the use of that folder.

I would also check to your plugins/products asap as well. If someone gained access to your admincp area, it's not farfetch'd to think that they didn't install a shell in there. A shell would give them pretty much ftp access to the server, so check for suspicious plugin names.

I would also recommend protecting those directories with some sort of .htaccess. It's another obstacle for intruders and it'll slow them down by a lot IMO.