Originally Posted by Babaganoosh

Better check that host's scope of support. If it's managed, they might run clamav or just grep for the common base64/eval or iframe fuckery but hosts (managed or not) should not be touching customer code...ever.

If there were malicious files found somewhere, deleting them isn't going to make much difference. They will just keep returning until whatever allowed them to be uploaded is fixed. Most of the time it's a vulnerable WP theme or plugin and in that case, it's absolutely not something the host should be messing with. A lot of fledgling hosting companies will do this but those are typically the ones who haven't had a lesson in liability yet.