If you do not have any own modifications, I would first check which version you are using (seems to be 188.8.131.52) and then replace the whole installation with a fresh copy of that version.
Just remember not to remove the
public folder (mostly uploaded images) and the
config.inc.php (and possibly .htaccess if you have something there) and as said above, move the
files directory outside the webroot and add the new location to config.inc.php.
You probably end up having an uploaded .phtml file in your files directory, but once the files directory is outside the webroot, the hacker can not use it anymore.
The code the hacker uploaded is pretty harmless, it just creates popup windows when you access a folder.