one of the web site (in Drupal 7.43) I am looking after (apparently not that well, although updates have always been applied) has been hacked. There's now extra text in the footer pointing to an Italian escort web site.

The following code is the culprit:

<div class=ctolls><div id='analytics_data'><a href='http://www.cerco-incontri.c-o-m/escort/lombardia/milano/donna/65844-karmen-3202833395' title='escort milano' target='_blank'>incontri escort milano</a> - ... </div></div></div>

(Note that I removed some of the code - that's the 3 dots. And I added dashes to the URL to avoid to point to it).

I don't know what to do to remove it ! :-( Any help would be appreciated.

Cheers, L@u

  • 1
    Welcome to Drupal Answers :) I'm afraid it's impossible to advise you on investigating/securing your specific server from here, as it requires access to the machine to work out exactly what's happened, and how it might be fixed. The linked duplicate contains all the general advice that can be offered from a distance, beyond that I'd strongly recommend that you engage the services of a security expert, preferably one with specific Drupal experience
    – Clive
    May 19 '16 at 9:05
  • My question was not generic (as marked by the duplicate) but specific to one problem. I've found the solution: I've deleted the 'ctolls_block' line in the drup_variable table. I assume that the breach has been done using some SQL injection before I ran the latest patch. May 19 '16 at 11:48
  • I will keep my eyes peeled to make sure I don't run into another kind of problem. I hope this might help some others. May 19 '16 at 11:54

Browse other questions tagged or ask your own question.