Malware Removal for HTML Site

My hosting provider has flagged my custom-built HTML/CSS site as infected, even though I’m not seeing obvious symptoms like pop-ups or redirects on the front end. I need a security-savvy developer to locate and eradicate every trace of the malware, harden the codebase, and bring the site fully up to date.

Because there’s no recent backup, the clean-up must be done carefully in place, preserving content and design while closing whatever hole let the infection in. After the site is clean I’d also like you to refresh any outdated libraries or scripts, add basic prevention (e.g., .htaccess tweaks, file-permission tightening, security headers), and deliver a fresh backup I can store off-server.

Key deliverables:
• Comprehensive scan and manual inspection of all HTML, CSS, JS, and server-side assets
• Complete removal of malicious code/injections and confirmation the host lifts the suspension/alert
• Security hardening and update of external scripts or frameworks used on the site
• One verified backup archive and a short report summarising what was fixed and how to prevent a repeat

Let me know your estimated turnaround and the tools you prefer (MalCare, ClamAV, custom grep scripts, etc.). I’m ready to move quickly—please share any similar clean-ups you’ve handled so I can choose with confidence.