I'm new to Drupal. My website has been disable due to malicious code found in /var/www/vhosts/domain.com/httpdocs/sites/all/themes/tao/tao/css.php

What should I remove in this file? http://pastebin.com/4xQixw13

  • If your site was hacked, you should put it offline, revert to pre-hacked state, fix security holes attacker used, and put it back online. Anything less is just a poor excuse for a solution, unless you or your hired specialist knows exactly what needs to be done. But you are asking, so you don't know. And that means your path of actions is wrong now.
    – Mołot
    Mar 1 '15 at 18:23

You should remove the entire file.

Also, this is not enough to fix your site. I would recommend exporting your content and doing a fresh install, with a fully updated version of Drupal.


Remove the file, but more importantly ask yourself how could that file have gotten there.

The Tao theme is a well known public theme so I doubt it came with this code in it, which mean that some system on your server that can write to protected, non-public folders put this file there.

You need to heal the server before you do a re-install or after a certain period of time the same code will get injected again.

You need a program to help you find the bad actors here. Try ClamAV to search your server. Hopefully it will find little but you need to face the possibility that you may need help for you hosting company or a nerdy friend.

Here is a how to article for Ubuntu https://askubuntu.com/questions/250290/how-do-i-scan-for-viruses-with-clamav

Good luck. This happened to me as well, it can be hard but you'll get past it. Learning to run a secure server is an important part of being on the web.

Here is a little more reading to help. https://www.drupal.org/security/secure-configuration

Not the answer you're looking for? Browse other questions tagged or ask your own question.