How to remove malicious scripts from admin pages after being hacked? The site running Drupal 7 was hacked and every administration page, e.g.

http://www.anysite.com/en/admin/dashboard

contains script tag in head section with malicious src attribute, e.g.

&lt;head&gt;
    ...
    &lt;script src="..."&gt;&lt;/script&gt;
&lt;/head&gt;


Those three dots in the src attribute was only for example same as the three dots line above :) In real code there is link to malicious web gymweb.it.

How can I remove this script tag? How the head section of admin pages is constructed?
If you suspect that your code has been altered, you should track any malicious code which could infect your webroot.

If you've access to the server terminal, try the following suggestions, otherwise sync the files into your local machine in order to run below commands.

Here are few general solution to get rid of the attacker:


Use some tools to scan for malicious PHP files (e.g. php-malware-finder, php-malware-scanner, phpscanner).
Look for your webroot for any suspicious files consisting base64_decode/eval which most commonly are used for obfuscation, e.g.

grep -R return.*base64_decode  .


If you found one, probably you've multiple of them. If so, please check: How to get rid of eval-base64_decode like PHP virus files thread for further suggestions.
If you know some specific pattern of the malware appearing in your source code (which you do), try scanning your code base for this name, e.g.

grep -R gymweb .


And depending on where these URLs were added, remove extra code or restore to the original version (either from VCS history or your recent backup before the infection).


If above won't help, try these suggestions which are more Drupal oriented:


When using code under version control (like Git), find the files which are not suppose to be there (git status) and remove them (git clean -f .).
Upgrade your Drupal core, to replace any modified files (drush up drupal).
Upgrade contrib modules using drush (drush upc --no-core).
Also scan your entire database for this name:

drush sql-dump --ordered-dump | grep gymweb 

If this still won't help, compare the code base from the backup before the infection with the current one (either by diff -r, using some diff GUI tool or use Git).


Check also:


How to get rid of eval-base64_decode like PHP virus files?
What does this malicious PHP script do?