rd1109

In replacing the WordPress files, I neglected step 3: Deactivate plugins. I don’t know what this is about, how to do it.

So, I replaced everything with a fresh version of WordPress, except for the wp-config file and the wp-content files. I could not find a folder for “uploads” in the downloaded WordPress program, so I don’t have a fresh “index.php” for that.

Also, nothing works yet, so what do I do?

Oh, I’m guessing I’m supposed to compare the fresh install versions of index.php files with my infected files. Given my lack of understanding of how any of this works, do you think I’ll be able to figure this out?

While I’m at it, in addition to installing WordPress on my server where it is, is it also possible to install it on my personal computer?

Once again, I already know that the infected files are all “wp-content/…./index.php” files. I can easily delete and reinstall everything else, but I have to do something with these files, as I have no other copies. As for the linked pages, the one that seems to be relevant is How to Remove Suspicious Code From WordPress Sites: https://www.wordfence.com/learn/remove-suspicious-code-wordpress/ . I can’t make any sense out of this, though. I haven’t the slightest understand of what malicious code looks like. I don’t think you appreciate that what may be obvious to you is a complete mystery to those not expert in this matter.

I see a detailed list of instructions for checking a hacked site. I also see links to related web pages. I remain unclear about how to actually remove malware code from the infected files, which I have already identified. They are all wp-content/…./index.php files. I have no backups. I need to know how to fix these infected files specifically. There must be some antivirus/malware program that can do this.

I don’t understand what to do based on the recommended web page. Offline I have a backed up SQL file, and a GZ file, whatever that is. Online, I see that the databases are stored separately from the WP files. I have a list of hacked files, all of which have been quarantined, that is taken out of the active WP installation online. I don’t see from the web page what to do. It says you need to use the same version of WP that you used originally. I don’t know which one that is. Nor do I know how to go about replacing parts of the WP installation. There is nothing on this page that tells me specific steps to take.

Thanks. I will follow those suggestions. I backed up the site long ago, but in any case, will an anti-virus check on the backup SQL suffice to detect an infection? I don’t really have an idea of how anti-virus programs work with such files–perhaps no different from any other?