This morning i noticed that wherever i want to click on menu and above menu i have invisible links leading to spam websites.
It looks to me that they are hard coded but i have no idea where to delete them or how did hacker get access to my website. Was it through Drupal, or through server ftp or some other way. I have several websites on this server so i guess its possible that all of them are attacked. Checking everything through drupal interface gives me no clue.
What steps should i do to prevent this from happening. Is there any way to find out when did this happen so i can maybe do server backup (websites are static so not much would be lost). Will it be enough to just change server/drupals passwords ?
Any help would be apreciated. Only thing i can think of right now is to put all websites in maintanance mode and wait for help.
UPDATE: With hacked module i found that 4 files were changed:
includes/bootstrap.inc (no change there except 1 extra emtpy line at the end of document)
.htaccess (change is only in non www to www, which i did myself)
robots.txt (Crawl speed default line was removed, nothing else).
includes/theme.inc (here is the change, at line 2704, three lines added).
if($variables['classes_array'][1]=='front')
"$variables['page_bottom'] .= '<div class="_all_wplink_2CUJ7TnE_cc"style="position:absolute;left:0;top:0;opacity:0.001;z-index:10;filter:alpha(opacity=0)">Don\'t pump.... here comes bunch of links."
if($variables['classes_array'][1]=='front')
Line 2 is huge and contains bunch of spam links. Easy to fix this but no idea how to prevent from happening again, how did hacker got access to server. Please advise.
