Restoring infected files can cause another suspension. The cleanup needs to address both the malicious changes and the way they entered.
What to check
- Obtain the host report and affected file list
- Preserve evidence and a known clean backup
- Remove the entry point before requesting reinstatement
What the results mean
Save the host report, inspect user access and outdated software, and verify a clean copy before requesting the account be reopened.
Keep the incident evidence
A host's malware report is a starting point, not a complete list of every change. Preserve the current files, database, logs, and notice before deleting suspicious content. Check administrator accounts, scheduled tasks, plugins, themes, uploads, and database entries for persistence. A clean looking homepage can still conceal a backdoor.
Clean before requesting reinstatement
Replace compromised credentials, remove malicious code, update vulnerable components, and confirm that the entry point is closed. Compare against a known clean backup, but do not simply restore the same weakness. Ask the provider what proof it needs, and monitor the site after it is reopened.
Can I just delete the flagged files?
That may remove a visible symptom while leaving unauthorized access or altered database content. Investigate the cause and verify the full site before treating the incident as resolved.
Greg Grigorian
For hosting trouble, migrations, backups, or a site that stopped working, get a clear diagnosis and a tested recovery path. Greg can review the setup and handle the work.