I have a 12 hour old backup but that is no use, Its also infected. The hack happened 20-08 it seems, that is the date of all the htaccess files. But I think we have found the security hole, its a module called simpleimportproduct from prestaworks. It has not been updated and when I asked the developer he say that our version has security problem. Unfortunately It was to late to update. The best thing now seems to be to delete the shop and start fresh. lesson learnned