Hi all, thanks a lot for your replaies, very appreciate!
My logic is the following. I have code what is somehow modified/hacked. Backups form the hoster are affected as well (only 10 day backed up, what is not enought). But I have my own backup 1 year old. During this time, I have not changed anything (still the same TB version, the same Panda theme... I just added maybe 5 new products...), so from code perspective this should be fine. And I am sure this backup was not modified. So I can use the back up to restore the shop. Correct?
Next, the database. My assumption, this is not affected. Generally, I think such hacks are done in code, not in database. Hence I can use the current one just connecting it to the restored code. It has huge advantures that all data (users, stock, orders, payments etc.) are there.
Is this correct? Can this replase / short-cut "Stage 1) remove the infection" @datakick