One possible solution:
Export all database tables from phpMyAdmin.
Open database file in a text editor such as Notepad.
Do a Find and Replace
Save and upload the database file back to the web server.
Good call. I’m no grep / sed expert, but I wonder if there is a text scraper that can find html in a text file…
Easiest way would be to import a backup of database – if you have backupbuddy or some other backup plugin there’s likely something that you can use.
Manually clearing these types of links really sucks and takes a long long time. IMO worst / most time consuming type of infection to remove.
Depending on how randomized these links are I would suggest making a database backup (MAKE SURE TO DO THIS FIRST!!!) and then trying a few SQL commands:
UPDATE wp_posts SET post_content = replace(post_content, ‘put copy of spam link here’,”)
If the links are randomized, though, then the only option is to remove manually 🙁
Best way to do this is to search database for this:
left: –
This will show you all of the links. From there, you can copy the contents of the infected tables (one by one) to a local html file, so the links are highlighted and you can see them much better.
Really speeds up the process 🙂 Good luck!
rngdmstr: That’s a good call and basically what I did in the end.
I’ll put this here in case others have the same problem. Luckily the malware used the same pattern throughout it’s content. It always included a single ”'<div style=”position: absolute; left: “”’ filled with anchor tags and ending with a single div. This SQL snipped did the trick:
update wp_posts
set post_content = CONCAT(LEFT(post_content, LOCATE('<div style="position:absolute; left:', post_content)-1), SUBSTRING(post_content, LOCATE('</div>', post_content)+7))
where LOCATE('<div style="position:absolute; left:', post_content) > 0
The malware had run twice and even stepped on it’s own entries so I had to run it twice which got 381 entries. That left 22 that I had to fix manually but that only took a few minutes.
Thanks!
Amazing! Nice work. Glad to hear it’s all sorted 🙂
