Do you need server and admin access?

For a thorough cleanup, yes, ideally SSH (or hosting-panel) access plus a Magento admin account. SSH lets us scan the full filesystem, compare core checksums and review logs; admin access lets us clean CMS blocks, layout updates and rogue users. If you can only provide admin access, we can still do a partial cleanup, but we’ll be upfront about what we can’t reach. Everything we touch is documented in the final report, and credentials are rotated when we’re done.