Removing potentially malicious code from template

Question

Our drupal site was hacked at some point recently, and I've been tasked to clean it up because nobody knows much about drupal here. I think I've taken care of most of the glaring security holes, and updated all the modules I could, but I've discovered there's still some gibberish/potentially malicious code on the site that I can't seem to track down.

At the top of every page drupal includes the site's CSS files, and then there's the three IE conditional blocks that are included in the seven_preprocess_html() function in themes/templates/seven/template.php. Immediately below those conditionals is the following block (I can't actually include the code because SE won't allow the characters in the textbox):

Then there are a series of legitimate .js script tags immediately below. The code in that block is throwing illegal token errors, and appears to be breaking other things in the page. I don't know if it's actually malicious or a corrupted file/db, but I obviously want it gone. Unfortunately I can't find it anywhere in any of the template files and I'm running out of places to look.

Anybody have any ideas on where this block might exist or how I can remove it?

Answer 1

The script may be included from any of the files involved in the build and render pipeline of Drupal as it outputs a page so it's tough, as you say, to pinpoint the single file (it may also affect multiple files). It may also be stored in the database via something included on every page.

So, instead of spot cleaning it's recommended that you start fresh with known-to-be safe Drupal files by importing your database and custom code over a new Drupal install. Drupal provides documentation for handling a hacked site that details why this is a better strategy.

You may have been hacked via the SA-CORE-2014-005 Drupal core vulnerability but even if not this detailed rollback blog post may also help http://befused.com/drupal/drupalgeddon

Answer 2

Turns out that it wasn't actually malicious code, it was a GZIP'd javascript file that was getting served onto the page, instead of the uncompressed version.

I disabled "Aggregate Javascript Files" in the Performance menu, and that fixed the problem.

Not sure exactly why this suddenly became an issue, but it's possible our host or a sysadmin made changes to Apache that broke something.