Technical consultation + written action algorithm

Good day! Our Joomla website has been hacked. Initially, the attackers defaced it (wrote "Hacked by Antonkill"). After attempts to clean it ourselves, the hackers returned and installed a malicious script: now, when accessing the site, a foreign blurry screen with a fake captcha (phishing/redirect) is displayed. The hosting provider constantly sends notifications about infected files.What needs to be done: A complete audit and cleaning of all website files and the database from viruses, shells, phishing scripts, and backdoors. Finding and eliminating the vulnerability that led to the hack (updating Joomla, plugins, closing holes). Checking the database for hidden administrators created by hackers. Setting up basic website protection (configuring .htaccess, restricting folder permissions, installing security components like RSFirewall or equivalents). Removing the site from antivirus/search engine blacklists, if it has been listed.Please contact specialists who have real experience with Joomla security. A guarantee for the work will be required (that the viruses will not return within a few days). Access will be provided via temporary FTP/SSH.