Database hacked - random posts are modified

Question

I have noticed that part of my posts was modified. Sometimes the original post is mixed with random words consist with random characters or content is replaced by spam. I have a lot of posts and I am not able to compare them manually but I have a database dump as sql files which I make sometimes. Is there a way to compare backup and current version of database to detect differences and replace spam? I already tried to compare sql files as text but it's time-consuming and my computer is too slow.

Answer 1

It's possible that the random stuff is not in the database; your answer doesn't make that clear. There could be some modified WP files that are inserting text in each displayed post.

Recovering from a hacked system is time-consuming, but can be done. Short list: update WP/themes/plugins to latest versions. Check the htaccess file against a default one. Change credentials on all WP accounts (set up a new admin account, sign in as that new account to make sure it works, then reduce privileges on the old 'admin' account). Change credentials on FTP and email and hosting accounts. Look for changed PHP files. Check the wp-config.php .

I wrote about the above in my blog (more for my use, since it is not visited by many) here: http://securitydawg.com/recovering-from-a-hacked-wordpress-site/ . There are other places that have similar info; mine is just things I've figured out over the years).

As for comparing databases, that's a complex item, since there will be much complexity to any SQL statement that would compare data contents in two separate WP databases.

I wrote a small program several years ago to compare file hashes with previous 'runs' of the program (each file's hash was stored in a table, then compared with a current runthrough of the program). That won't help you here, but it is one way to keep track of file changes.

If you can figure out when the problem occurred, your hosting place might have an old backup of the database and files they could restore. But that would erase any changed to the blog since then, so that might be a last resort.

Again, you can recover from this. It will take some time and effort, though. Good luck.