The first thing you should do is to change passwords, and check for newly created accounts. Technically you should treat the whole system as compromised until you do a full wipe and re-install. Even backing up is risky after a break-in, as you could backup tainted files, but that's a trade-off, as always.
Are you hosting the site yourself? If not, your best approach would be to notify your hosting provider. Hopefully they have logs of activity, or can access yours. They're also in the best place to surmount your permissions issues.
If you are, your logs are usually somewhere like /var/log/, depending on what you were running on the server, different services were likely compromised. /var/log/auth.log is a good place to start.
You mention deleting folders. Deleting information isn't the best way to find out what happened, as there could be clues in the files left behind. You should certainly move them, as your server could be being used for nefarious purposes at the moment.