Server Virus Removal

I have 2 websites which have been recently hacked (defaced). We have recovered them now but I suspect there are remnants of a virus still on them as occasionally. I require someone to first back up the sites off-line (in case there are any problems. Then do a thorough scan. Then disinfect the website. Make changes so the site cannot get hacked again, then produce a full report of what you have found and done. The first 50% milestone will be released when the report of what is wrong with the site and what recommendations you have. . The second 50% when the work has been completed and is nice and secure. Then as an additional task, but only if you are capable if this is to install a firewall on my server which will only allow certain IP addresses to modify files. Do not include this in your bid but tell me how much additional you will charge for this task.