We recovered their website from a website builder that ghosted them. Once we were able to get the files, we moved it to our cloud server hosting and eliminated over 30 infected files, either placed their by an exploit with a plugin or the website builder. We locked the site down so this won’t happen again.