Comment on One of my Drupal sites was hackedComments−msantos12yLooks like OP is another victim of Asprox Botnet.Create a full snapshot of the machine for forensic analysis later. Then follow @patio11 advice and rebuild from the metal up.That's the only sure way you have a "clean" machine, then sieve through the snapshot and try and find the hacker's entry point.−msantos12yAn easy start point is checking for large number of XSS-alike requests in your httpd logs.... a dirty example (I apologise in advance) grep --color=auto -i -s -P "(\/cgi-bin\/|\.exe|phpmyadmin|awstats|acunetix|(%22|%27|'|\")(%20| |\+)*and[^\w]|sqlmap|xss|BENCHMARK|eval[^\w]|phpinfo|[^\w]ord[^\w]|md5[^\w]|substr|information_schema|prompt|iframe|base64|waitfor|script[^\w]|[^\w]sleep[^\w]|hex[^\w]|unhex|chr[^\w]|char[^\w]|concat[^\w]|concat_ws|windows.*?win\.ini|union.*?select|etc.*?shadow|etc.*?passwd|\.\.\/|%(25)*2E%(25)*2E%(25)*2F|\.\.%(25)*2F|\/\.\/|%(25)*2F%(25)*2E%(25)*2F|%(25)*2F\.%(25)*2F|\\|%(25)*5C|%(25)*45%(25)*45|%[01][0-9ABCDEF])" access_log
Comments
Looks like OP is another victim of Asprox Botnet.
Create a full snapshot of the machine for forensic analysis later. Then follow @patio11 advice and rebuild from the metal up.
That's the only sure way you have a "clean" machine, then sieve through the snapshot and try and find the hacker's entry point.
An easy start point is checking for large number of XSS-alike requests in your httpd logs.
... a dirty example (I apologise in advance)