If the virus infecting your website is locate in the database itself, you can use virus scanner according to the guide located on this link. Afterwards a notification will appear at the bottom of the page.
In this case we see that the infected database is sample123_inf and infection is located in the wp_posts table. According to the description it is about string CoinHive. With different types of infections the name of the virus will be different according to the infection. We will add additional guides.
Note: We recommend to follow these steps with care for it may lead to making your website non functional.
DATABASE INFECTION COINHIVE TYPE
First step is to create a backup of the infected database by downloading it to the PC: Go to list of databases, select infected database and select Manage – Download.
Then we can log in to the shell console connected to the hosting, e.g. following this guide:
Web console Shell article
Ten run a command to download the database to the shell:
mysqldump -u username -p password -h host -P port database > infected_dump.sql
It is necessary to replace username and password with current login username and password, host with external host (for example for MariaDB 10.1 database it would be mariadb101.websupport.sk), port with port (e.g. 3312).
Then it is possible to start a script on the dump of the database (backup in a text format) which will clean the database from the CoinHive:
perl -pe 's#<script[\s\S]*?>[\s\S]*?(CoinHive|authedmine)[\s\S]*?<\/script>##g' < infected_dump.sql > clean_dump.sql
Afterwards you can upload the database to the server by a command:
mysql -u username -p password -h host -P port database < clean_dump.sql
Then check the functionality of the website, changes are visible immediately.
As a last step it is recommended to delete unnecessary files for so they wouldn’t take up storage. Use command:
rm infected_dump.sql clean_dump.sql