PHP Ratel class in Drupal 7 - Ratel is a spam bot, Remove it.

Here is what I found:

• We have a Drupal 7 website that has a frontend that load very slowly (> 15 seconds per load, sometimes).  A performance problem.
• It looks like it is trying to call some remote URL/APIs that causes the timeout problem.
• Our colleague did a research by installing a PHP profiling tool called xhprof to do profiling on the page.
• It turns out that there is a PHP class called "Ratel" that takes quite a long time to execute.
• However, even if we are doing a code-scan, we can't even see a file that contains the word "Ratel"
• Thanks to this article, and this gist, it turns out that there is a SEO spam bot that is executed ONLY when you are login to the site.
• In other words, you will see this performance problem more likely when you are logging in to Drupal.
• I recommend you to read the article above.
• I wonder, this is not just affecting Drupal, but mainly on Wordpress, as mentioned in the article above. 

Here is how to solve:

• Once I know how this bot works, I quickly located a .jpg file (named a.jpg) that is actually a PHP script.
• You open this file via text editor, and you will see the code.  
• There are two reasons (to us) why you can't find this code
• Since this is an "image uploading attack", your text editor will not scan image.  
• Which means, if you are doing a grep or code scan and you only search for *.php, *.txt or other "text" files, you will not find anything.
• This Ratel class is base64_encode(), which means, again, you cannot find it even if it is not .jpg.
• To quickly fix this, you can either 
• Trace the source and see which function is calling this file, and remove the malicious code.
• Or you edit the .jpg file using text editor and simply comment out the code that execute the function (in order to make it not running)
• Hola! You fix the problem.

Lesson learned:

• Update your software, when you can
• If you scan your code again and again and you cannot find anything, chances are the code is hiding from you.  And normally it is via base64_encode() or other functions.  Take a look at that.
• Normally when you spot a problem, but you cannot find the code that causes it even if you have done a code-scan, chances are very high that your website is exploited/attacked/hacked.  This would be a serious problem and you need to pay serious attention to it.  This is not an easily ignored small incident.
• Nowadays spammers/hackers are so smart to hide the code from any text file, but other commonly ignored files, like .jpg, .png or others (because they are programmer!).  Take a look at that if you don't have any idea.
• Do not allow executing any PHP in image directory, there is a config in Apache .htaccess which can do that.  I saw that in iTheme Security, in which there is a config for that.  Not sure if Nginx can do that, but I think so.
• Install necessary tool to do profiling.  In this case my colleague used xhprof
• There are another PHP native functions called debug_backtrace() and debug_print_backtrace().  It will show how a PHP program is executed.  You can always see how things work.

Hope it helps someone.