My hosting provider has blocked my Drupal website due to: sending spam using local e-mail sockets /var/www/vhosts/site domain/httpdocs/sites/all/themes/chaymae/css/mailer.php.php

I am currently not using the mentioned theme, but this is a standard theme in Drupal. I also have installed the BOTCHA module on the website and it's active. Can anyone help to solve this problem?


Your hosting provided blocked your website, because it was used for sending the spam from using PHP scripts which were suspiciously uploaded to your Drupal installation folder (by using some vulnerabilities).

Why this happened?

There could be many issues, including contrib modules or Drupal core vulnerabilities.

Please follow Drupal Security advisories to be up-to-date.

If your Drupal version is 7.32 or below, there is Highly Critical issue (SA-CORE-2014-005) which people call Drupalgeddon. See FAQ and Drupalgeddon project for more details. Also my GitHub repo (drupageddon) for educational purposes (to understand how it works).

What to do

To prevent that from happening, first of all, check Status/Reports in Administer page to see if you've any Security warnings and your site needs some upgrades.

Then you may consider to log-in to the website (ssh) and scan for suspicious files.

You should look into these tools to help you with restoring your Drupal security:

  • Security Review
  • Site Audit
  • Hacked!

    If you use drush (and you've alias set-up to your environment), check for Hacked! module. It can find which core files or modules were hacked, but it could find only modified one, not the one which are extra.

If you're using drush, other trick can be to generate your make file (drush generate-makefile) from your current Drupal site (however this is probably not necessary, but it keeps track of your old version of modules), then run drush up. This will upgrade your Drupal core and all contrib projects and apply any pending database updates. How would that help? It'll actually upgrade all core/module files by replacing old directories with fresh version of stable release files (so any extra files which aren't part of the module would be automatically removed).

Finding suspicious files

To fix your infected website installation, you need to find files which were hacked and malware files in your Drupal installation folder.

You actually found one at (which is a good start):

/var/www/vhosts/site domain/httpdocs/sites/all/themes/chaymae/css/mailer.php.php

which needs to be removed as soon as possible. Probably you have more of them.

If there is no access to shell, transferring over FTP (ncftpget -R) and checking locally would help. Or find other way to backup your whole site and test it locally for any extra files or hacked files.

If you don't use git, I would suggest you to download your Drupal site into folder and create git repository, so you can track the changes.

For example:

git init
git add -A .
git commit -m 'My original files.' -a

Then upgrade all your core and modules and review the changes (git diff), and commit all again.

Here are few commands which can be useful to find suspicious files (in your webroot):

grep -R return.*base64_decode  .
grep --include=\*.php -rn 'return.*base64_decode($v.\{6\})' .
find . -name \*.php

Above results doesn't mean necessary suspicious files, but you need to use your common sense to identify which files aren't Drupal. Usually these files are obfuscated.

Please find the following repository with common php-exploit-scripts to give you some idea what you could deal with. See also: What does this malicious PHP script do?

Unblocking your site

Once you find your problem and identified malware files, then remove these files from the server and upgrade your core and modules to the recent secure version and inform your hosting provider that you've removed malware so they can unblock your site.

  • Almost a good answer. You forgot to mention Drupageddon and the fact that compromise might happen at ftp level, for example. Surprise surprise, some hosting providers still does not support encryption... One connection from a café, or any more or less open network, and wham, you're done. – Mołot Sep 18 '15 at 6:24
  • @Mołot Thanks for suggestion, I've added it. Initially I didn't want to, as it could be quickly out-dated, but it's worth to mention. Secondly I wasn't sure if the question is actually on-topic, I actually voted it to close my-self, but then I figured it out it can be answered in Drupal-way. – kenorb Sep 18 '15 at 10:04
  • Here it's not about Drupal and non-Drupal way, but Drupal and non-Drupal cause, so I believe both possibilities should be presented. With more accent on the Drupal one of course. As for "quickly outdated" - I hoped for it last 10 years and it's simply not happening :( – Mołot Sep 18 '15 at 11:30

Not the answer you're looking for? Browse other questions tagged or ask your own question.