Strange Problems after "Site restore"

Hi there,

here is what happened: A friend of mine call me for help as his provider send him an E-Mail that his site contains viruses. This was an MODx Version from 2015.
It was hacked. As I took a look with a FT-Client I found a lot of strange files there so my plan was to delete all the strange files (it have names like 2736dhgs.php e.g. an some big .ico files)
So I manually delete all this files that I have found. Than I want to put ist back on the server and make an Update to the newest MODx-version. But the provider detected more viruses instantly. But I don't know what Files. I can't find anymore files with strange names or so.

So my second approach was to make a new clean install, put the "old" assets folder on the server (contains all need files for the template and stuff) and install all
needed Extras and finally change the DB-Settings to the installation of the "OLD" version of the site.
This approach was like "half-successfully". After deleting the cache (with FTP) ist shows the site. But here are my problems:

The pictures (assetManager) do not appear. (Pictures uses in the template will show. Only the "content-pictures" with AssetManager.

The Menu (wayfinder) do not appear.

I' can't login to manager no more. I use the correct PW and login, but it say's it where wrong. I have 2 users. So I logged in to phpmyadmin. My plan
was to manually edit the User inside the DB. I set a new md5-hash, deleted the salt, an set it from the Hash-Class from hashing.modPBKDF2 to hashing.modMD5.
But id do not work. It says that the PW was not correct.

What can I Do?

Cheers, Chris