Fixing the problem:
-
Download a copy of your database either by using a plugin (such as the one mentioned at the beginning of the post) or via the phpMyAdmin (as described here).
-
Once you get a copy of the DB on your hard drive, open it using Notepad. Then search (Ctrl+f) for “rss_f541b3abd05e7962fcab37737f40fad8″
-
This was determined by Chris as the starting point to look for issues, if your DB has this string then your DB is hacked. Look through the DB to find gibberish that is usually preceded by mentions of “Events Calendar” which is a built in WP plugin that is serving as the point of injection of the exploit.
You will now have two options to fix this.
Option 1
-
If you make frequent backups of your DB
-
Open all recent copies of your DB and search for “rss_f541b3abd05e7962fcab37737f40fad8″, select the one that does not have this string.
-
Note the date/time the clean DB was downloaded and also note posts/comments that were made since the DB download. If the number of posts/comments are excessive, then use method 2 (explained below).
-
If not, simply overwrite the corrupt DB by importing the clean file using phpMyAdmin. If using phpMyAdmin is not your thing, use method 2 will not make much sense either, the only reason for method 2 is to help the frequent poster/commenter from not loosing their work.
I had no idea that people could do this!! Jeez, it’s a jungle out there. I will definitely be using that backup plugin now – thanks!
I agree with this post as backups are certainly important. I’ve come across a situation similar to this that put our business back a whole week due to not properly backing up our servers. Take advantage of any automated tools – they’re worth it..even if you need a quick fix.