Exactly, there is no point in externally scanning your website now.
What you should do is scan your website to find out what the problem is so you can start solving it as soon as you can. I suggest you take look at Security Module MageFence - one of the features is the malware scanner that will scan your website internally, and find the problem. Check it out here: http://www.extensionsmall.com/mage-fence-security.html
This extension will also give you the full protection in the future: it will scan your website for malware on regular basis, it will scan your system for changes and give you a list of all changed files so you can confirm the changes you have made yourself and spot changes that are a result of a potential security breach, it also gives you protection against brute force attacks by blocking IP addresses after too many failed login attempts.
You can also see all the changes made by admin users in Admin Activity Log.
It also comes together with Two-Factor Authentication module that will prevent unauthorized access even if your credentials somehow get compromised.
MageFence is a well-rounded security solution developed to prevent these kind of hack attacks exactly.
. Any suggestions are appreciated thanks in advance.
