Hijacked once more (Part 2)

The other day, I received this email:

Dear Troy:

Your web hosting account for twittren.net has been deactivated (reason: terms of service violation).

Although your web site has been disabled, your data may still be available for
up to 15 days, after which it will be deleted.

If you feel this deactivation is in error, please contact customer support as
soon as possible.

Thank you,

I called to helpdesk.  He said there was "phishing" being done from my account.  That is (I think) using my account to wrongfully solicit information from others.  They saw a suspicious file someone had planted in my files.  I removed the file.  I looked for other files that looked suspicious.

I called back to ask if they could tell me what files were recently added.  They could not.  They had a list of contractors I could hire to help me.  I don't have money for that.

I found a phrase in one of my index files.  I googled it, and it was an Indonesian phrase, but I could not find it's meaning.

After I deleted a bunch of files and mysql databases, my domain still would not come up.  I called for istructions of how to reset my account.  My mid-fortynes, my "Troyishness", I  could not figure out what I needed to do.

I called and asked that my account cancelled.