My Drupal site has been compromised.

Although I applied all modules updates and update my Drupal core to 7.35, it is still compromised.

What would the next logical step to take be?

  • Backup site for analysis; delete the entire site; restore from latest known good backup; patch and update to current standards; change ALL credentials. – user39950 Mar 23 '15 at 7:20
  • i already did. only didnt changed theme folder – Hitu Bansal Mar 23 '15 at 7:22

Sorry to hear that. The steps you should take are as follows:

  • If you have drush access, install drupalgeddon by typing drush dl drupalgeddon.
  • Run drush drupalgeddon-test. You will likely find several accounts which you did not create. Remove them.
  • Install hacked to find out which (if any) files have been changed.
  • Read this article.

Not the answer you're looking for? Browse other questions tagged or ask your own question.