DRUPAL dPh HACK, HOW TO CLEAN MY DRUPAL INSTALL HACKED BY dV AND dCi

[buythiscomputer]

DRUPAL dPh HACK, HOW TO CLEAN MY DRUPAL INSTALL HACKED BY dV AND dCi PILLS ?

Hello, I am sorry to write this here as I cannot find any info about Drupal dPh hack, maybe it can be useful to others and maybe I can get some help ?
Sorry also to start a new thread, I just realized that it might be better than writing in another one.

My Drupal website has been hacked and I found in the Drupal install      "includes"     folder a file named       "ssl.inc"
Can you tell me what this file does, how is it run, and if everything is ok now that I have deleted it or if it will be created again to spam my website again ?
It seems that only Google see the dPh keywords ar "dV" "dCi" etc...  as they are not shown on my pages or in the source of my pages but I can see them when i check Google CACHE only.
Thank you for your help an experience about this DRUPAL dPh HACK. Here is what I can see in the "ssl,inc" file:

php function _1343129181($i)
{$a=Array('SFRUUF9VU0VSX0FHRU5U',
'R29vZ2xlYm90',
'SFRUUF9VU0VSX0FHRU5U',
'YmluZ2JvdA==',
'SFRUUF9VU0VSX0FHRU5U',
'bXNuYm90',...
;return base64_decode($a[$i]);

[reason for edit by SteveW: removed most of the malicious code]

[SteveW]

Hello,

The code you posted from the ssl.inc file was malicious. It contained hyperlinks to about 50 websites selling those drugs. They were served when the visitor to the page was Googlebot, bingbot, or msnbot. That would help explain why only the robots saw the links, and you didn't when you visited your pages yourself. 

(I removed most of the code because there is no point leaving it publicly available.)

Deleting the file was the correct thing to do, but you should find out if Drupal was supposed to have a legitimate file with that name in that folder. If so, you'll need to find the legitimate version of the file, and put it back there. Maybe the Drupal forum can help you. ( http://drupal.org/forum )

Deleting the file was a good first step, but the hackers were able to put the file there because there is a security hole somewhere. You'll need to improve your security or they will put the file there again.

You should do the security precautions described on my page http://25yearsofprogramming.com/blog/20070705.htm and the other related pages.