What to search when your site was hacked

I would like to share some experience with hack of my multi webhosting, where i had Drupal based websites.

From my experience you should search with Total commander on phrases inside the files for :

• eval( that is the first warning and the most used and included in the snippet
• base64_decode
• or both together eval(base64_decode 
• also <?php $ (also some files in drupal have these parameters too, but check it, usually the snippet is in the first line moved with blank line really far to the right -> you will se the scroll bar on the bottom)
• files with 3 letters name like hta.php, but also admin.php or something linke that are included
• and also check with isset($_POST
• strtolower($
• isset($
• eval($

Usually you can find compromised files pretty easy - 3 letters and dont have name of the directory above, as it is ussually for modules, which i can also check on Drupal 7 with https://www.drupal.org/project/hacked than they should not been compromised by added lines. But there could be a lot of malware in sites/all/libraries or sites/all/modules .

Also try to find files with "hack" or "*.hack", "*.hacked". I have found some malware code in sites/default/files/tmp