{"id":25073,"date":"2026-07-09T11:59:06","date_gmt":"2026-07-09T09:59:06","guid":{"rendered":"https:\/\/kunskap.websupport.se\/?post_type=ht_kb&#038;p=25073"},"modified":"2026-07-09T11:59:08","modified_gmt":"2026-07-09T09:59:08","slug":"virus-infected-database","status":"publish","type":"ht_kb","link":"https:\/\/kunskap.websupport.se\/en\/kb\/virus-infected-database\/","title":{"rendered":"Virus-infected database"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">If a security breach on your website has infected the database itself, you can use a virus scanner following the instructions below.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\" \/>\n\n\n\n<p class=\"wp-block-paragraph\">Note! We recommend you take the following steps carefully, as this can cause site malfunctions.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\" \/>\n\n\n\n<h4 class=\"wp-block-heading\"><strong>Coinhive database attack:<\/strong><\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">First, create a current backup of the database by downloading it to your computer: in the database list, click the three dots on the right and select <strong>Download<\/strong>.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"783\" height=\"239\" src=\"https:\/\/kunskap.websupport.se\/app\/uploads\/sites\/4\/2021\/01\/chrome_CWQZxbF5PJ-783x239.png\" alt=\"\" class=\"wp-image-17557\" srcset=\"https:\/\/kunskap.websupport.se\/app\/uploads\/sites\/4\/2021\/01\/chrome_CWQZxbF5PJ-783x239.png 783w, https:\/\/kunskap.websupport.se\/app\/uploads\/sites\/4\/2021\/01\/chrome_CWQZxbF5PJ-50x15.png 50w, https:\/\/kunskap.websupport.se\/app\/uploads\/sites\/4\/2021\/01\/chrome_CWQZxbF5PJ-1536x468.png 1536w, https:\/\/kunskap.websupport.se\/app\/uploads\/sites\/4\/2021\/01\/chrome_CWQZxbF5PJ-60x18.png 60w, https:\/\/kunskap.websupport.se\/app\/uploads\/sites\/4\/2021\/01\/chrome_CWQZxbF5PJ-100x31.png 100w, https:\/\/kunskap.websupport.se\/app\/uploads\/sites\/4\/2021\/01\/chrome_CWQZxbF5PJ.png 1636w\" sizes=\"auto, (max-width: 783px) 100vw, 783px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Then log in to the shell console associated with your hosting, for example following these instructions:<br><a href=\"https:\/\/kunskap.websupport.se\/kb\/webbkonsol-shell\/\">https:\/\/kunskap.websupport.se\/kb\/webbkonsol-shell\/<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Run this command to download the database to the shell:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">mysqldump -u username -p password -h host -P port database &gt; infected_dump.sql<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Replace username, password, host, and port with your actual database login credentials, which you can find in your credentials section.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Next, run a script on the database dump (a database backup) that will clean the database of CoinHive infection:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">perl -pe 's#[\\s\\S]*?(CoinHive|authedmine)[\\s\\S]*?##g' &lt; infected_dump.sql &gt; clean_dump.sql<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">You can then upload the database back to the server with this command:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">mysql -u username -p password -h host -P port database &lt; clean_dump.sql<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Then check that your site is working properly, which it hopefully will be.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">As a final step, we recommend you remove unnecessary files to save space with this command:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">rm infected_dump.sql clean_dump.sql<\/pre>\n","protected":false},"excerpt":{"rendered":"<p>If a security breach on your website has infected the database itself, you can use a virus scanner following the instructions below. Note! We recommend you take the following steps carefully, as this can cause site malfunctions. Coinhive database attack: First, create a current backup of the database by downloading&#8230;<\/p>\n","protected":false},"author":44,"template":"","format":"standard","meta":{"footnotes":""},"ht-kb-category":[572],"ht-kb-tag":[],"class_list":["post-25073","ht_kb","type-ht_kb","status-publish","format-standard","hentry","ht_kb_category-database"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.9 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Virus-infected database - Websupport kunskapsdatabas<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/kunskap.websupport.se\/en\/kb\/virus-infected-database\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Virus-infected database - Websupport kunskapsdatabas\" \/>\n<meta property=\"og:description\" content=\"If a security breach on your website has infected the database itself, you can use a virus scanner following the instructions below. Note! We recommend you take the following steps carefully, as this can cause site malfunctions. Coinhive database attack: First, create a current backup of the database by downloading...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/kunskap.websupport.se\/en\/kb\/virus-infected-database\/\" \/>\n<meta property=\"og:site_name\" content=\"Websupport kunskapsdatabas\" \/>\n<meta property=\"article:modified_time\" content=\"2026-07-09T09:59:08+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/kunskap.websupport.se\/app\/uploads\/sites\/4\/2021\/01\/chrome_CWQZxbF5PJ.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1636\" \/>\n\t<meta property=\"og:image:height\" content=\"499\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"1 minute\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/kunskap.websupport.se\\\/en\\\/kb\\\/virus-infected-database\\\/\",\"url\":\"https:\\\/\\\/kunskap.websupport.se\\\/en\\\/kb\\\/virus-infected-database\\\/\",\"name\":\"Virus-infected database - Websupport kunskapsdatabas\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/kunskap.websupport.se\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/kunskap.websupport.se\\\/en\\\/kb\\\/virus-infected-database\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/kunskap.websupport.se\\\/en\\\/kb\\\/virus-infected-database\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/kunskap.websupport.se\\\/app\\\/uploads\\\/sites\\\/4\\\/2021\\\/01\\\/chrome_CWQZxbF5PJ-783x239.png\",\"datePublished\":\"2026-07-09T09:59:06+00:00\",\"dateModified\":\"2026-07-09T09:59:08+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/kunskap.websupport.se\\\/en\\\/kb\\\/virus-infected-database\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/kunskap.websupport.se\\\/en\\\/kb\\\/virus-infected-database\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/kunskap.websupport.se\\\/en\\\/kb\\\/virus-infected-database\\\/#primaryimage\",\"url\":\"https:\\\/\\\/kunskap.websupport.se\\\/app\\\/uploads\\\/sites\\\/4\\\/2021\\\/01\\\/chrome_CWQZxbF5PJ-783x239.png\",\"contentUrl\":\"https:\\\/\\\/kunskap.websupport.se\\\/app\\\/uploads\\\/sites\\\/4\\\/2021\\\/01\\\/chrome_CWQZxbF5PJ-783x239.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/kunskap.websupport.se\\\/en\\\/kb\\\/virus-infected-database\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/kunskap.websupport.se\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Virus-infected database\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/kunskap.websupport.se\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/kunskap.websupport.se\\\/en\\\/\",\"name\":\"Websupport kunskapsdatabas\",\"description\":\"Websupport kunskapsdatabas\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/kunskap.websupport.se\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Virus-infected database - Websupport kunskapsdatabas","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/kunskap.websupport.se\/en\/kb\/virus-infected-database\/","og_locale":"en_US","og_type":"article","og_title":"Virus-infected database - Websupport kunskapsdatabas","og_description":"If a security breach on your website has infected the database itself, you can use a virus scanner following the instructions below. Note! We recommend you take the following steps carefully, as this can cause site malfunctions. Coinhive database attack: First, create a current backup of the database by downloading...","og_url":"https:\/\/kunskap.websupport.se\/en\/kb\/virus-infected-database\/","og_site_name":"Websupport kunskapsdatabas","article_modified_time":"2026-07-09T09:59:08+00:00","og_image":[{"width":1636,"height":499,"url":"https:\/\/kunskap.websupport.se\/app\/uploads\/sites\/4\/2021\/01\/chrome_CWQZxbF5PJ.png","type":"image\/png"}],"twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"1 minute"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/kunskap.websupport.se\/en\/kb\/virus-infected-database\/","url":"https:\/\/kunskap.websupport.se\/en\/kb\/virus-infected-database\/","name":"Virus-infected database - Websupport kunskapsdatabas","isPartOf":{"@id":"https:\/\/kunskap.websupport.se\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/kunskap.websupport.se\/en\/kb\/virus-infected-database\/#primaryimage"},"image":{"@id":"https:\/\/kunskap.websupport.se\/en\/kb\/virus-infected-database\/#primaryimage"},"thumbnailUrl":"https:\/\/kunskap.websupport.se\/app\/uploads\/sites\/4\/2021\/01\/chrome_CWQZxbF5PJ-783x239.png","datePublished":"2026-07-09T09:59:06+00:00","dateModified":"2026-07-09T09:59:08+00:00","breadcrumb":{"@id":"https:\/\/kunskap.websupport.se\/en\/kb\/virus-infected-database\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/kunskap.websupport.se\/en\/kb\/virus-infected-database\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/kunskap.websupport.se\/en\/kb\/virus-infected-database\/#primaryimage","url":"https:\/\/kunskap.websupport.se\/app\/uploads\/sites\/4\/2021\/01\/chrome_CWQZxbF5PJ-783x239.png","contentUrl":"https:\/\/kunskap.websupport.se\/app\/uploads\/sites\/4\/2021\/01\/chrome_CWQZxbF5PJ-783x239.png"},{"@type":"BreadcrumbList","@id":"https:\/\/kunskap.websupport.se\/en\/kb\/virus-infected-database\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/kunskap.websupport.se\/"},{"@type":"ListItem","position":2,"name":"Virus-infected database"}]},{"@type":"WebSite","@id":"https:\/\/kunskap.websupport.se\/en\/#website","url":"https:\/\/kunskap.websupport.se\/en\/","name":"Websupport kunskapsdatabas","description":"Websupport kunskapsdatabas","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/kunskap.websupport.se\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"}]}},"_links":{"self":[{"href":"https:\/\/kunskap.websupport.se\/en\/wp-json\/wp\/v2\/ht-kb\/25073","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/kunskap.websupport.se\/en\/wp-json\/wp\/v2\/ht-kb"}],"about":[{"href":"https:\/\/kunskap.websupport.se\/en\/wp-json\/wp\/v2\/types\/ht_kb"}],"author":[{"embeddable":true,"href":"https:\/\/kunskap.websupport.se\/en\/wp-json\/wp\/v2\/users\/44"}],"version-history":[{"count":1,"href":"https:\/\/kunskap.websupport.se\/en\/wp-json\/wp\/v2\/ht-kb\/25073\/revisions"}],"predecessor-version":[{"id":25076,"href":"https:\/\/kunskap.websupport.se\/en\/wp-json\/wp\/v2\/ht-kb\/25073\/revisions\/25076"}],"wp:attachment":[{"href":"https:\/\/kunskap.websupport.se\/en\/wp-json\/wp\/v2\/media?parent=25073"}],"wp:term":[{"taxonomy":"ht_kb_category","embeddable":true,"href":"https:\/\/kunskap.websupport.se\/en\/wp-json\/wp\/v2\/ht-kb-category?post=25073"},{"taxonomy":"ht_kb_tag","embeddable":true,"href":"https:\/\/kunskap.websupport.se\/en\/wp-json\/wp\/v2\/ht-kb-tag?post=25073"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}