Malware issue

  In every case this is a premium (extra paid) service only

And we have found this to be worth the money, though a well-configured free mod_security can do some very heavy lifting. We eventually installed a mid-grade imunify on our vps's - it will notify you of a an injection, and will clean when you invoke manually. (There is an automatic version but it is pricey.) On our most important sites we also run Joomla security (Admintools Pro or RS Security) for business clients who are willing to pay for it. And a country IP blocker, though it can't filter out VPNs, still cuts down on the ability to even reach (or find) a site in the first place. Except for mod_security, none of this is free. But a 10-second imunify one click cleanup is cheaper than two hours of billable time wasted manually locating and restoring a couple dozen files.