The hack OP is refering to (iconfont) is listed as "Critical · actively exploited" - so delete folders is no solution, they will reappear again. Also if it would be so easy as deleting files/folders (and nothing else!) there would not be so much heat regarding joomla/helix/sppb updates. You have to take down your site and either restore a clean and working backup or rebuild everything from scratch, ie install joomla and all extensions again, hardening the site, once the site is live again hope for the best, watch it 24h if any new attacks occur.