I'm going to answer the 2nd question.
I was wondering if there is a quick way other than to manually remove
these URLs from the google webmaster tools?
Google is explicitly states that removal through Google Search Console (the new name of webmaster tools) is the fastest.
If the hacker created entirely new, user-visible URLs, you can have these pages more quickly removed from Google search results by using the Remove URLs feature in Search Console. This an entirely optional step. If you simply delete the pages and then configure your server to return a 404 status code, the pages will naturally fall out of Google's index with time.
But they also understand that this is not feasible for some cases:
The decision to use URL Removal will likely depend on the number of
new, unwanted pages created (too many pages might be cumbersome to
include in Remove URLs), as well as the potential damage these pages
could cause users. To keep the pages submitted through URL Removal
from ever appearing in search results, be sure the pages are also
configured to return a 404 File not Found response for the
So while you can block these pages in robots.txt -- you are not taking either of the corrective steps as explained by google.