CE Phoenix Cart Forum

How does one go about un-hacking a website please.

Sorry to hear that you've been hacked!

If you have back-ups, that would be the way forward. If not, you should be able to, fairly quickly, install a new site and add the add-ons you need, add the override files and css and then the db (you might be able to use the same db - that depends whether or not that has been hacked as well).
Of course, you should make sure to close the security hole before going live again

//Daniel

The most important thing is to take your site offline while you clean any infected files.

We need more data to even have a chance of helping you.
What ecommerce software are you using? What version?
WHat PHP version? WHat host? What is the "hack"?

The only site that I know of yours is currently up and running on osCommerce 2.3

trophy wrote: ↑Mon Jan 22, 2024 8:21 am How does one go about un-hacking a website please.

How do you know that the site has been hacked?

Sorry that your site has been hacked.

I was reading somewhere where a person just overwrote all the current sites files with a good known backup copy, and the site was still hacked. The thread was saying to delete all the old files from the server, and upload a fresh copy of the files, which should remove any files added by the hacker. The trouble is that if a hacker got in once, the chances are they will be able to do it again, and quickly. The second time could be even worse than the first.

Hopefully all the data, and especially the customer data is all secure and has not been touched.

You could also try asking your hosts for help and advice.

By going to https://www.virustotal.com and put in the website and there it is .
I have two web site one using the old OSC which I will shut down and one with CE Phoenix v1.0.8.0, which I will keep and move forward with.
My host is Host Gator,
Now looking around I can see where some hacking is.
I have very limited knowledge but it would appear a folder has been installed, called "ssI" which has these folders "certs, csrs, keys, private.
with this type of text of which there are 31 of them attached at various dates within a few months.
To me does not look correct.

If you delete the ssl directory, make sure to back it up first. That looks like an SSL certificate, so it may turn out to be something that you need, perhaps installed by your host.

Do not post "private" keys in the public forum.

i got the same folder on mine from my host who uses cPanel (AutoSSL)
the dates that the various files have matches up with when it updated my lets encrypt SSL certs.
also matches up with the cPanel email i got, i also get an email from an SSL tracker website i use to check the dates, and tells me when it sees a new cert (which i got a few hours later)

so it is perfectly normal to have those folders/files