Just recieved this email from my hosting:
Your web hosting account for your domain xxxx has been deactivated, as of 06/06/2012. (reason: terms of service violation - malware/virus)
This deactivation was due to a Terms of Service violation associated with your account.
Any ideas how to fix this? I have a couple of wordpress sites and the hosting company is bluehost.
Ok, there is no easy way to "scan" via an FTP especially as you don't know exactly what you're looking for.
You could download your entire site contents, then do a normal search in the files for things like base64 and eval which will often be obscured in some way. Sadly you have no definite way of telling wether you've got everything or not, hell, there could be code injected in your database by now.
Your best option IMHO is to assume the whole site is compromised, and re-install a fresh version of WordPress and your plugins, and definitely change all of your passwords! I won't write a guide on that as there are plenty online.
Just be aware that not all base64 encoded strings are malware. So you should always decode it to make sure you're not removing a real function in your script.
You should download all the files and use Total Commander to search them on windows or on linux use grep
