• I manage a website with a WP blog located in a subdirectory. The hosting company is Dot5. We recently discovered that the blog had been infected with the WP trojan that ClamXav calls PHP.Shell-38. (Here is the best info I could find on it: http://security.stackexchange.com/questions/37111/wordpress-hacked-found-a-suspicious-class-wp-style-table-php.)

    Our hosting service detected 180 some infected files. I read up on the WP folder hierarchy, backed up, then deleted all the infected files. Well, they scanned again and found more. Based on my understanding of the maliciousness of this trojan, I decided the thing to do was delete everything in the directory, restore the website from a clean local copy, do a fresh WP install, and then selectively upload files containing our settings and content to restore the blog.

    Needless to say, this did not work. I had no idea what SQL beyond the fact that it was some kind of database language. My assumption was that it must be in the files that I had backed up. When I learned it was not, I assumed all was lost. Checking in with the Dot5 people, however, I now understand that they store SQL databases in a different location, and that all of our content is preserved intact. (Whether is has been corrupted by the trojan is, of course, a separate issue…)

    I found instructions for how to use use phpMyAdmin to export and import SQL databases. The export seemed to work. I have one document named wrd_e7aohid1d5.sql (25.2 MB) and another named custsql-d505.eigbox.net.sql (26.5 MB) from two separate attempts. Initiating the import from different places, I think. (I am entirely ignorant of SQL and do not understand all the options.)

    Yet, when I attempt to import either of these files into the SQL database for the current, clean WP install, phpMyAdmin errors when I attempt to import it. I am able to successfully select the file I wish to import, but then it displays this error: “You didn’t enter any data to import!”

    Although the text of the error message did not suggest this, it occurred to me that the problem might be the size of my files, which both exceed the stated 10,240 KB max, could very well be the problem. Zipping the larger one down to 6.1 MB, I instead get the error message, “Error in ZIP archive: Compressed size is not equal with the value in header information.” Same with the other. (I just used the Mac OS compression utility, if that is relevant: right click, Compress “filename.”)

    Does this mean my original database is corrupt? Or did I do something wrong exporting it? Or…?

    These are the instructions I have been trying to follow: http://codex.ww.wp.xz.cn/Restoring_Your_Database_From_Backup.

    Any suggestions tremendously appreciated. This is the blog of an academic journal, and we have a lot of high-quality content we do not want to lose. I can see that it is there in the original database, but am at a loss for how to extract it in a form that I can then get back online for our readers.

    Just one other idea, is there any way to simply redirect the current, blank WP install to the old database? They are on the same server. If I can fix this just editing a line or two in a handful of .php files, that would be fantastic and probably much easier than all this mucking about in phpMyAdmin.

    Many thanks,
    Patrick

Viewing 5 replies - 16 through 20 (of 20 total)
  • Thread Starter ijfabblog

    (@ijfabblog)

    Thanks for being sure I wrap-up all my loose ends. I just installed Wordfence and am doing a scan now. I’m done working for the day, but will follow up on this thread with results. Can’t tell you how much I appreciate all your expert assistance!

    Patrick

    You are welcome Patrick, I hope you enjoy the rest of your evening.

    Thread Starter ijfabblog

    (@ijfabblog)

    Hi again. The Wordfence scan turned up nothing more than a few weak passwords. Are there still further steps you would make to ensure the safety of the five files detected by the first scan?

    Hey! I’m glad you have sufficiently recovered from the stress of a dead hacked site.

    I don’t have the WP Antivirus plugin installed on any of my sites so I’ll have to go from memory. Even though it has the limited comment note you posted above, there is a link in the plugin to a report about what suspicious files were found. If you find and click the link the report will show you all of the questionable files with nothing x’d out.

    Look at each file name of the suspect file and if you have uploaded a fresh version of it, you can assume it is a false positive. If the suspect file is not a part of any new upload, open the suspect file and compare it to a known good file. If you can’t find where the file came from, it was likely put there during the hack.

    If you use Notepad++ to edit your files, it has a built in document compare. But since you only have 5 or less files to look at, a careful look might be all you need to determine a false positive or not.

    Best wishes for your site…

    Hi ijfa

    Here is a simple trick you can use to restore your site.

    Go to your current database using phpmyadmin

    Remember the old prefix

    Search for it in the entire database

    Wherever you find it. Just replace it with the new prefix.

    You could also run a SQL query for the same

Viewing 5 replies - 16 through 20 (of 20 total)

The topic ‘Trouble restoring SQL backup’ is closed to new replies.