Re: Cleaning up from the Oct. 15th hack.
Muzaffer Tolga Ozses <[email protected]> Fri, 31 Oct 2014 19:55:00 +0200
| Newsgroups | gmane.comp.php.drupal.support |
|---|---|
| Message-ID | <CAMAQ3nJ=H2XW9NHoWa1xSVpD_vgNNbyWXJzodA6QmBhh-Va8PA@mail.gmail.com> |
Drupalgeddon identifies a few PHP files in FirePHP that comes with devel. On 31 Oct 2014 19:51, "Patrick Avella" <[email protected]> wrote: > Thanks Dave and Muzzafer, I got a syntax error from drush when installing > the drupgeddon module. > > Has anyone been able to list when common files and avenues the attack hit > yet? While we all know we got hacked, there seems to be no clear > description of the contents of the attack besides what's initially visible > (drupal mega role, evilevily, etc) > > On Fri, Oct 31, 2014 at 1:44 PM, Metzler, David <[email protected]> > wrote: > >> It’s not complete but I’ve heard of people using: >> >> >> >> https://www.drupal.org/project/drupalgeddon >> >> >> >> To help get a handle on the files cleanup. I haven’t heard anything about >> db yet, but there are some useful links on the project page. >> >> >> >> >> >> Good Luck, >> >> >> >> Dave >> >> >> >> >> >> *From:* [email protected] [mailto:[email protected]] *On >> Behalf Of *Patrick Avella >> *Sent:* Friday, October 31, 2014 10:04 AM >> *To:* [email protected] >> *Subject:* [support] Cleaning up from the Oct. 15th hack. >> >> >> >> Hi, I maintain around 60 multisites that got hacked like all sites on the >> 15th. Has anyone developed a method of cleaning out the database for >> malicious code? The file system I can handle on my own. >> >> PSA chances are you were hacked on Oct 15th please visit Drupal.org to >> learn more. >> >> -- >> [ Drupal support list | http://lists.drupal.org/ ] >> > > > -- > [ Drupal support list | http://lists.drupal.org/ ] > -- [ Drupal support list | http://lists.drupal.org/ ]