What to do when your blog has a virus

The last time my blog was hacked was… let me remember… uh… yesterday.

But hackers know my blog since quite a long ago and they even made my blog be marked by Google as a site that may harm your computer.

Never mind, all these attacks gave me some experience about the typical WordPress hack.

So, when you realize your blog has been hacked, follow these steps:

Backup your ftp content

Simply open your favorite FTP client and download all the content of your site

Backup your MySQL database

Every decent hosting plan now supports PhpMyAdmin. With this tool you can export and save your entire database in a matter of seconds (or minutes, according to the size of your DB).

Look at this picture:



with your WP database selected, click on Export (1)
Then this is the next page:


remember to:

1) Have all tables selected

2) Select SQL as database type

3) Check Structure, Add IF NOT EXISTS and Enclose table and field names with backquotes. Leave unchecked Add AUTO_INCREMENT value because WP tables already have an auto increment column

4) Check Data, Complete inserts, Extended inserts and Use hexadecimal for BLOB

5) Check Save as file and None. Choosing zipped can be too CPU intensive for your hosting plan

Hunt for the virus

I experienced two types of viruses, both with inserted code into my WP files.

I got some more similar codes injected in my pages, but all of them have been inserted at the end of the page, in the last row.

So you should search for eval or document.write and see if there are strange strings like the ones I got.

Then, delete or comment them and you should have your blog cleaned and virus-free

I am thinking about making a plugin doing all this hard work for you, at the moment the only one existing seems to be WordPress Exploit Scanner but I would like something more complete.

Source: http://www.emanueleferonato.com/

Was this helpful? 0 0 Comments

You're reading What to do when your blog has a virus.