The site running Drupal 7 was hacked and every administration page, e.g.


contains script tag in head section with malicious src attribute, e.g.

    <script src="..."></script>

Those three dots in the src attribute was only for example same as the three dots line above :) In real code there is link to malicious web gymweb.it.

How can I remove this script tag? How the head section of admin pages is constructed?

  • <script src="..."></script> isn't malicious, looks normal, how do you know it's malicious? Maybe you just installed some module which provides extra script file. Can you paste to what it's pointing to?
    – kenorb
    Commented May 31, 2016 at 1:03
  • Those three dots in the src attribute was only for example same as the three dots line above :) In real code there is link to malicious web gymweb.it Commented May 31, 2016 at 6:35

3 Answers 3


If you're using Seven as your admin theme (which is the out of the box default) then the script may have been added in a template file inside /core/themes/seven

I think the easy approach would be to pretend you're upgrading Drupal 7 and delete all the files and folders with the exception of the sites folder.

After you "upgraded" your Drupal, if the problem still persists, then it means it may be somewhere in your sites folder.

Go to /sites/all/themes/yourtheme/templates and Check all template files .tpl.php to see if any evil code was added to them.

Also, check your /sites/all/themes/template.php file to see if some evil code was added there, you should only see theme functions and regular Drupal code here.

Keep a lookout for any strange.php file names.

In addition, you can check if some module was added or altered using the Hacked! module.

If still no resolution, then most likely the script is in your Database. Due to you allowing FULL HTML or PHP in your text boxes or your DB was hacked.

  • Yes, I use Seven, but in themes/seven there are only images, css and 3 php scripts: maintenance-page.tpl.php, page.tpl.php and template.php without any direct script tag adding. Commented May 31, 2016 at 6:39
  • 1
    @PetrFelzmann Your core may have been altered, so it is still a good idea to "upgrade" your Drupal.
    – No Sssweat
    Commented May 31, 2016 at 6:43

If you suspect that your code has been altered, you should track any malicious code which could infect your webroot.

If you've access to the server terminal, try the following suggestions, otherwise sync the files into your local machine in order to run below commands.

Here are few general solution to get rid of the attacker:

  1. Use some tools to scan for malicious PHP files (e.g. php-malware-finder, php-malware-scanner, phpscanner).
  2. Look for your webroot for any suspicious files consisting base64_decode/eval which most commonly are used for obfuscation, e.g.

    grep -R return.*base64_decode  .

    If you found one, probably you've multiple of them. If so, please check: How to get rid of eval-base64_decode like PHP virus files thread for further suggestions.

  3. If you know some specific pattern of the malware appearing in your source code (which you do), try scanning your code base for this name, e.g.

    grep -R gymweb .

    And depending on where these URLs were added, remove extra code or restore to the original version (either from VCS history or your recent backup before the infection).

If above won't help, try these suggestions which are more Drupal oriented:

  • When using code under version control (like Git), find the files which are not suppose to be there (git status) and remove them (git clean -f .).
  • Upgrade your Drupal core, to replace any modified files (drush up drupal).
  • Upgrade contrib modules using drush (drush upc --no-core).
  • Also scan your entire database for this name:

    drush sql-dump --ordered-dump | grep gymweb 
  • If this still won't help, compare the code base from the backup before the infection with the current one (either by diff -r, using some diff GUI tool or use Git).

Check also:


Quickest way is to re-download drupal, extract it over your drupal directory and overwrite all files. And clear all cache/restart memcached/varnish then check if the script is being included still. If it is, then you probably need to look overwrite all your contrib modules, and lastly check your custom modules/themes. It's most probably an eval(base64_decode()) call on an encoded bit of PHP code somewhere in your drupal includes. It'll be difficult to find manually.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.