Site was hacked via DB need help cleaning up

You need to start working your way through these resources:

How to clean and fix hacked WP blog:
https://codex.www.ads-software.com/FAQ_My_site_was_hacked
https://www.ads-software.com/support/topic/268083#post-1065779
https://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/
https://ottopress.com/2009/hacked-wordpress-backdoors/
https://www.jtpratt.com/how-to-fix-a-hacked-wordpress-blog/
https://sakinshrestha.com/wordpress/fix-if-your-wordpress-site-is-hacked/
https://www.wpbeginner.com/wp-tutorials/how-to-find-a-backdoor-in-a-hacked-wordpress-site-and-fix-it/

Harden your WP installation: https://codex.www.ads-software.com/Hardening_WordPress

Additional Resources:
https://sitecheck.sucuri.net/scanner/
https://www.unmaskparasites.com/
https://blog.sucuri.net/2012/03/wordpress-understanding-its-true-vulnerability.html

Hi Digiboom,

Sorry to hear you’re having issues with the database- it definitely takes a lot of work to get stuff out of there.

If you’re not familiar with using queries to remove or update the tables so that you can remove the entries, then one option you should consider is to export the database as a SQL file using a mysql client like phpmyadmin. When the file is exported, you can use a text editor like Notepad++ and then run a text-based search for entries that you know are injections. If the injections are URLs, then you should identify the entry and then search and eliminate it. You can also look for text strings this way. It’s the “code-less” way to do make the changes. Otherwise, you’re going to need to run a query and then update in order to make changes in the database.

Without seeing the database we won’t be able to know what actually needs to be removed. If its a base64 injection, then you’ll need to try the isolate at least one instance of it and then search to delete it.

If you have a clean backup – then that is your BEST option. Otherwise, you’re going to be either slogging through the database looking to remove the entries, or starting afresh.

After you have finished removing the entries,you can then import the database back in using a MySQL client such as phpMyAdmin.

Thanks for all your help, I recommend people do the following..

Within phpadmin select your db, use the search (Regex) function and search for any of the words used on the hacked website such as “we are justice” and/or any other nonsense like that..particularly look for a youtube embed code with the extension =loop1 on it.

Now here’s the kicker..these guys are so bad I was able to follow the image to a site that led to a folder of images that included a particularly odd hashtag which I searched on twitter and low and behold I found the twerp. They were dumb enough to list the region they are from on their hacksplash page and I can confirm the personal twitter account belongs to someone from that region..unfortunately it’s not on U.S. soil but middle eastern so there isnt much we can do about it legally but damn it if i’m not ready to fight back and scare the bejeezus out of him.