The best way to de-compromise a website is to restore a backup from before the hack. Then upgrade that version.
If the hack is weeks old and using a bakcup is not an option, then i would advice a complete reinstall and transfer your products.
transferring users and their ordes is possible but very difficult and therefore expensive.
in future stay tuned to security updates,
kind regards, Sebastian
