title: Index.php/index.html files daily getting injected with include code
body: <p>My site got hacked, updated from Drupal 7.3 to 7.59 after the issue occured for the security updates, but the issues are still coming up. Also I reverted the server to a state before the attack.</p>
  
  <p>The server has had index files created daily, in weird places like css/js folders, but also in existing index.php/index.html, and these index files have this code in them:</p>
  
  <pre><code>&lt;?PHP
   @include "\157\157\157\157\157\157\157\157\157\157\157\157";
  </code></pre>
  
  <p>I put the string (not this specific string) and the path is pointing to an ico file, but the ico file if you change from .ico to .php or .html or .txt, has a huge array </p>
  
  <pre><code>/*79026*/
  &lt;?PHP 
     @include some-folder-name/.81abc878.ico;
  
  /*79026*/
  </code></pre>
  
  <p>I don't really understand the 79026, it's the same number on index.
  The include path is a string of numbers/letters that I had to use <a href="https://www.unphp.net/" rel="nofollow noreferrer">https://www.unphp.net/</a> to decode due to it's format. My theory is that it's just intercepting post data and it's injecting that data into the .ico file which is actually a php script. I don't have access to that file, but if I do find it again I'll be sure to post an update. </p>
  
  <p>Any help or guidance in fixing this would be great. </p>