patrickkidd

rngdmstr: That’s a good call and basically what I did in the end.

I’ll put this here in case others have the same problem. Luckily the malware used the same pattern throughout it’s content. It always included a single ”'<div style=”position: absolute; left: “”’ filled with anchor tags and ending with a single div. This SQL snipped did the trick:

update wp_posts
set post_content = CONCAT(LEFT(post_content, LOCATE('<div style="position:absolute; left:', post_content)-1),  SUBSTRING(post_content, LOCATE('</div>', post_content)+7))
where LOCATE('<div style="position:absolute; left:', post_content) > 0

The malware had run twice and even stepped on it’s own entries so I had to run it twice which got 381 entries. That left 22 that I had to fix manually but that only took a few minutes.

Thanks!