It depends, on exactly how the hackers are getting in and if there is any files they loaded. I would worry more about blocking them from getting in at all, rather than worrying about deleting them once they are in.
10-4 to that but so far no one seems be able to figure out how they are doing it.
I see all the stuff about the Install file, but many say they have done that and it is still happening. Here and vb.com.
Many say 4.1.x was not part of this exploit, but they got me under those conditions.
I want to start comparing Plugins with others to see if that will show a trend.