I got a "site may be hacked" warning from Google in one of my Drupal sites and while working to resolve this, I noticed that a hacker gained access to the /includes/theme.inc
folder and added codes inside the template_process_html(&$variables) function
I commented out the part that was adding links on my site and kept it as it is. Now after 2 days I checked the site again and saw that another set of codes are inserted in the same function which now looks like this:
// Render page_top and page_bottom into top level variables.
$variables['page_top'] = drupal_render($variables['page']['page_top']);
$variables['page_bottom'] = drupal_render($variables['page']['page_bottom']);
// Place the rendered HTML for the page body into a top level variable.
$variables['page'] = $variables['page']['#children'];
$variables['page_bottom'] .= drupal_get_js('footer');
if($variables['classes_array'][1]=='front')
$variables['page_bottom'] .= '<div class="_all_wplink_isKF9JNf_cc" style="position:absolute;opacity:0.001;z-index:10;filter:alpha(opacity=0)">The beginning of the process you should find some nice bargains is the internet. You could possibly find a websites selling such designer shoes at much reduced prices. You will, therefore, need to observe a quantity of sites and compare prices before finally settling for the offer it is possible to comfortably have. However, you have to remember that you won\'t have the chance to try the shoe you want to purchase. Additionally you need always be wary from the online sale scams.Custom Cheap Jordans is genuine. There are 24 customized versions of Jordans. You can buy, Jordan, does not have any for good quality, very supportive shoes to wear while to the basketball judge. They come in various colors, market, they are generally have a great performance top basketball shoes, <a href="http://unemploymentclaims.com/order-72-10-11s.html">72-10 11s for sale</a> Michael Jordan famous. Women Air Jordan Shoes are designed with women\'s basketball players <a href="http://labcitrico.com/72-10-11s-jordan-for-sale.html">read more</a> was formed. With superior quality materials and design ...... 100s of links here
$variables['head'] = drupal_get_html_head();
$variables['css'] = drupal_add_css();
$variables['styles'] = drupal_get_css();
$variables['scripts'] = drupal_get_js();
So now it is clear that site has a backdoor, I need to find that backdoor to keep my site clean and remove that warning from Google.