Thanks for the advice on this one guys. In the end Bluehost deleted everything… yay… I have a backup from early May, but it’s clearly infected, my computer’s antivirus flagged up a php file inside and it looks a complete mess. At this stage I’m wondering if it’s worth throwing away a year and a half’s work for the sake of a nice clean install and starting over… Which is kinda depressing.