Ok, An update to this whole situation. We were able to determine how they got in and all the files that they loaded. We have cleaned up most of the mess. Thank you everyone for your help.