Both. Normally the hacks are cleaned automatically but there are instances where a hack that is more complex, or is present in sensitive locations of a website. In such situations, our engineers intervene to further investigate the file and manually remove the malware.