Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Possible Duplicate:
My server's been hacked EMERGENCY

I've got a new client whose site looks like it has been hacked. It's running Drupal and I have run Hacked on it to verify that the file structure hasn't changed. I can add the Paranoia module, but it's a bit late.

Unfortunately, the site was developed with a lot of PHP code inserted directly into nodes, so a lot of custom code is sitting in the database. It's all run through eval().

What I'd like to know is how to quickly search through the database to determine if there is malicious PHP or Javascript that I need to clean up before migrating the site over to a more secure environment.

I can search for '' so could search for that.

Any thoughts or best practices would be appreciated.

share|improve this question

marked as duplicate by John Gardeniers, Michael Hampton, Scott Pack, mulaz, HopelessN00b Sep 27 '12 at 22:44

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1 Answer 1

To hide the source code, the most common method hackers use is encode it using base64 and then use base64_decode and eval() function to execute the code at runtime.

So, I would suggest you dump your database as text by using mysqldump, then search for base64 string.

share|improve this answer
    
That was very useful, thanks! –  Mike Gifford Sep 8 '12 at 16:58

Not the answer you're looking for? Browse other questions tagged or ask your own question.