Ultimately, fix wordpress malware virus will inform you that there's not any htaccess inside the directory. You may place a.htaccess record in to this directory if you would like, and you can use it to manage usage of this wp-admin directory from Ip Address address or address range. Details of how you can do that are plentiful around the net.
Don't make the mistake of believing that your web host will have your back as far as WordPress copies go. Not always. While they say they do, it's been my experience that the company may or may not be hop over to these guys doing proper backups. Why take that kind of chance?
Is to delete the default administrator account. This is important because if you don't do it, a user name that they could attempt to crack is already known by malicious user.
Can you view that folder Imagine if you go to WP-Content/plugins? If so, upload that blank Index.html file into that folder as well so people can not see what plugins you have. Someone can use that to get access because even if your visit the site existing version of WordPress is up to date, if you're using a plugin or an old plugin with a security hole.
There are always going to be risks being online (or even just being alive!) Also it's easy to get caught up in the panic. As soon read this as we get caught up in the panic, we often put the breaks on. This isn't a fantastic response. Just take some common sense precautions, then forge ahead. It is going to need to be dealt with then, if something bad does happen and of quaking in your boots 23, no amount will have helped. All is good, if nothing does and you have not made yourself sick.