1

I got a "site may be hacked" warning from Google in one of my Drupal sites and while working to resolve this, I noticed that a hacker gained access to the /includes/theme.inc folder and added codes inside the template_process_html(&$variables) function

I commented out the part that was adding links on my site and kept it as it is. Now after 2 days I checked the site again and saw that another set of codes are inserted in the same function which now looks like this:

// Render page_top and page_bottom into top level variables.
  $variables['page_top'] = drupal_render($variables['page']['page_top']);
  $variables['page_bottom'] = drupal_render($variables['page']['page_bottom']);
  // Place the rendered HTML for the page body into a top level variable.
  $variables['page']              = $variables['page']['#children'];
  $variables['page_bottom'] .= drupal_get_js('footer');
  if($variables['classes_array'][1]=='front')
    $variables['page_bottom'] .= '<div class="_all_wplink_isKF9JNf_cc" style="position:absolute;opacity:0.001;z-index:10;filter:alpha(opacity=0)">The beginning of the process you should find some nice bargains is the internet. You could possibly find a websites selling such designer shoes at much reduced prices. You will, therefore, need to observe a quantity of sites and compare prices before finally settling for the offer it is possible to comfortably have. However, you have to remember that you won\'t have the chance to try the shoe you want to purchase. Additionally you need always be wary from the online sale scams.Custom Cheap Jordans is genuine. There are 24 customized versions of Jordans. You can buy, Jordan, does not have any for good quality, very supportive shoes to wear while to the basketball judge. They come in various colors, market, they are generally have a great performance top basketball shoes, <a href="http://unemploymentclaims.com/order-72-10-11s.html">72-10 11s for sale</a> Michael Jordan famous. Women Air Jordan Shoes are designed with women\'s basketball players <a href="http://labcitrico.com/72-10-11s-jordan-for-sale.html">read more</a> was formed. With superior quality materials and design ...... 100s of links here 


  $variables['head']    = drupal_get_html_head();
  $variables['css']     = drupal_add_css();
  $variables['styles']  = drupal_get_css();
  $variables['scripts'] = drupal_get_js();

So now it is clear that site has a backdoor, I need to find that backdoor to keep my site clean and remove that warning from Google.

Improve this question
4
  • Hi, it's not possible to guess how your site has been hacked from here I'm afraid. Ive marked this as a duplicate of the general my-Drupal-site-has-been-hacked question we have (there are some excellent generic suggestions there) - that's the most advice we can offer here, as most of what you need to know to investigate and fix this is actually related to server administration and not Drupal – Clive♦ Dec 7 '15 at 9:52
  • Clive I went through that answer and it is not related to my question as my site is already patched for that Security Advisory. – Ajay M Dec 7 '15 at 16:16
  • I just wanted to know if any one has a similar problem where in they got outside code being injected into the theme.inc folder. No one ever has mentioned about theme.inc hack in any of the thread here or in any other forums. – Ajay M Dec 7 '15 at 16:17
  • Once you have write access to the server, which your attacker seems to have (again though, you need someone to check that in-situ), you can write to any file. So the actual file that has dodgy stuff in it is irrelevant. You need to find out how the attacker gained write access to your server, and fix it. If there's a Drupal related fix available, you'll find it in the duplicate, but it's likely not to be – Clive♦ Dec 7 '15 at 16:41

Browse other questions tagged or ask your own question.