How to Get Rid of Malware

I recently cleaned a site infected with malware, so I’m sharing the fix with you all.
Approx. sites are affected so far.

Need help? Let us clean your site.

To fix a hacked website, follow these steps:

Step 0
Backup site
1. Backup database and site files. If you can’t do it, ask your web host.
2. Disable SQL remote access, especially if you’re using Plesk.
3. Change SQL user password.

Step 1
Rebuild site
1. Download a fresh WordPress copy:
2. Extract, add wp-config.php from your infected site inside wordpress folder ( make sure you check its content and clear malicious lines – if any ).
3. Add plugins and theme manually, one by one, inside /wp-content/plugins/ and /wp-content/themes/
4. Upload everything back to your server.

Step 2
Reset site URL
Restore site URL:
Easiest way would be to edit wp-config.php file via FTP or hosting dashboard ( replace with your own domain name ).

define( 'WP_HOME', '' );
define( 'WP_SITEURL', '' );
Step 3
Clean local files
If site rebuild still contains plugins or theme from a backup, all index.php and JS files may be corrupted as well.
Look for “String.fromCharCode”, “mndfhghjf”, “blackentertainments” and “list.insertBefore(s, list.childNodes[0])”.
Insert the following script with pack.php file and place it inside your root folder. This way you can pack all PHP and JS files, which can be cleaned locally.

exec("find . -name '*.php' -o -name '*.js' | tar -cvzf php-js.tar.gz -T -");

Search and replace tools for malicious strings inside multiple files: dnGrep, grepwin, VisualGrep ( mac ), powergrep ( paid ).
Example of infected JS file:

Step 4
Database check
1. As a precaution measure, look for “blackentertainments” and “lobbydesires” then for “String.fromCharCode”.This way you will know if other tables are infected as well.
Attackers usually alter wp_posts and wp_options tables. Example:

2. Check users with administrator privileges

Step 5
Major update
Perform a major update, making sure core files, theme and plugins are up to date.
Disable any unmaintained abandoned plugins.

Step 6
Blacklist status & Google cache
Site should be verified with Google search console. To refresh indexed pages, ask for a re-index.
This way, any infected cached pages listed on Google will be updated.

Try our Free site check.

More details about this hack. Changes found within the database:

1. SiteURL and Home values from wp_options were changed to:
Other sites have various paths like:

2. All entries from wp_posts table are corrupted with scripts injections

Malicious scripts using these domains:


Malicious network includes several related subdomains: