If they got into the database and where able to upload mallicious files, then most likely the server itself was hacked (or cPanel/FTP account). First step would be to ensure that the server itself is clean and not vulnerable. Any other action would be useless until this is done.
If you have a backup of your database, then you can always restore your posts etc..