We definitely conduct an investigation into the malicious activity to find out what has happened. The next steps would depend on what has occurred or been infected – the steps below are some examples of what we do (but not limited to);
If we can safely turn off a feature (plugin etc) and fix the issue then we will do so.
If we can determine that the problem has happened recently then we can restore a previous clean version of the website.
If we can simply remove the code from the website so that the website isn’t infected then we will do so then proceed with creating a permanent fix for the website.