The site running Drupal 7 was hacked and every administration page, e.g.
http://www.anysite.com/en/admin/dashboard
contains script tag in head section with malicious src attribute, e.g.
<head>
...
<script src="..."></script>
</head>
Those three dots in the src attribute was only for example same as the three dots line above :) In real code there is link to malicious web gymweb.it.
How can I remove this script tag? How the head section of admin pages is constructed?
If you're using Seven as your admin theme (which is the out of the box default) then the script may have been added in a template file inside /core/themes/seven
I think the easy approach would be to pretend you're upgrading Drupal 7 and delete all the files and folders with the exception of the sites folder.
After you "upgraded" your Drupal, if the problem still persists, then it means it may be somewhere in your sites folder.
Go to /sites/all/themes/yourtheme/templates and Check all template files .tpl.php to see if any evil code was added to them.
Also, check your /sites/all/themes/template.php file to see if some evil code was added there, you should only see theme functions and regular Drupal code here.
Keep a lookout for any strange.php file names.
In addition, you can check if some module was added or altered using the Hacked! module.
If still no resolution, then most likely the script is in your Database. Due to you allowing FULL HTML or PHP in your text boxes or your DB was hacked.
If you suspect that your code has been altered, you should track any malicious code which could infect your webroot.
If you've access to the server terminal, try the following suggestions, otherwise sync the files into your local machine in order to run below commands.
Here are few general solution to get rid of the attacker:
php-malware-finder, php-malware-scanner, phpscanner).Look for your webroot for any suspicious files consisting base64_decode/eval which most commonly are used for obfuscation, e.g.
grep -R return.*base64_decode .
If you found one, probably you've multiple of them. If so, please check: How to get rid of eval-base64_decode like PHP virus files thread for further suggestions.
If you know some specific pattern of the malware appearing in your source code (which you do), try scanning your code base for this name, e.g.
grep -R gymweb .
And depending on where these URLs were added, remove extra code or restore to the original version (either from VCS history or your recent backup before the infection).
If above won't help, try these suggestions which are more Drupal oriented:
git status) and remove them (git clean -f .).drush up drupal).drush upc --no-core).Also scan your entire database for this name:
drush sql-dump --ordered-dump | grep gymweb
If this still won't help, compare the code base from the backup before the infection with the current one (either by diff -r, using some diff GUI tool or use Git).
Check also:
Quickest way is to re-download drupal, extract it over your drupal directory and overwrite all files. And clear all cache/restart memcached/varnish then check if the script is being included still. If it is, then you probably need to look overwrite all your contrib modules, and lastly check your custom modules/themes. It's most probably an eval(base64_decode()) call on an encoded bit of PHP code somewhere in your drupal includes. It'll be difficult to find manually.
<script src="..."></script>isn't malicious, looks normal, how do you know it's malicious? Maybe you just installed some module which provides extra script file. Can you paste to what it's pointing to?