Recovering a hacked Drupal system

In order to check if your Drupal 7 website has been hacked, install the following modules:

drush dl site_audit
drush dl drupalgeddon


clear drush cache and run:

drush cache-clear drush
drush asec

Some attack does two things: firstly, in creates NEW php files scattered throughout your directory structure. The files are all 494 bytes long, and end in "php" so they are easy to find. Run the following command to see if you have any:


find . -size 494c -name "*.php"
...and then run this command to delete them:


find . -size 494c -name "*.php" | xargs rm

And the second thing this exploit/attack does is alter EXISTING files with the malicious code. To see if any of your normal Drupal PHP files have been injected with this PCT4B code, go to the root of your site and issue the following command:


grep -Rl PCT4BA6ODSE .

This will look through your entire site, looking for instances of either newly-created or pre-existing files that have been hacked with this variant - files that will now allow outside attackers to bounce commands off your server. Assuming the result of this command indeed lists affected files, you can then run this additional command:


grep -Rl PCT4BA6ODSE . | xargs sed -i 's/<[?]php.*PCT4BA6ODSE_.*[?]>/<\?php \/\/ RECOVERED FILE \?>/g'

This will sweep through all affected files, removing the malicious code but saving the rest of the file.

Additionally you can install and check your website with

https://www.drupal.org/project/hacked
https://www.drupal.org/project/md5check
https://www.drupal.org/project/security_review
https://www.drupal.org/project/paranoia

modules.

The following commands are optional to launch and check as they often give false alerts, but often times they also help to identify infected files:


find . -type f -name '*.php' | xargs grep -l "eval *(" --color
find . -type f -name '*.php' | xargs grep -l "base64_decode *(" --color
find . -type f -name '*.php' | xargs grep -l "gzinflate *(" --color


You might also want to additionally search your server for the following files:


.options.php
.config.php
.ajax.php
.utf33.php
eh16s7.php
general34.php
f92i4d.php
43f2ri.php
defines.php
functions.php
include30.php
article.php
plugin.php
system18.php
gallery.php
cache.php
Apache_Solr_Document.php


You might also read similar post on http://duntuk.com/how-check-if-your-drupal-site-was-hacked-and-how-fix-it