Web site is down 3 day

[Ms_X]

Hi,

I have a problem that web site is unavailable 3 day. Sometimes it gives me a blank page,sometimes:

Index of /

* _README_
* cgi-bin/
* favicon.ico

Apache Server at mysite url Port 80

I restored working back up yesterday nignt and today everything was working fine, now trying to load main page i get:

Index of /

* _README_
* cgi-bin/
* favicon.ico

Apache Server at mysite url Port 80

Again tech support running restoration of the back up,but I can't do it every day and not know real reason. They are investigating it now. THe strangest thing is :I have not changed a single thing today. MAybe someone had similar problems or knows what could be wrong? I really need help or any advice...(I use hostmonster).

TIA

[kobra]

If happening regularly, I would inspect every file to see if it belongs, all your payment & email settings in the admin....

High possibility that you have been hacked

[Ms_X]

Thanks a lot for reply,kobra,

I will check, but there are hips of files, so i am not sure i will be able to detect hacked ones. What should i do if i am hacked?it lookes like that to me as well, I have done all the steps from the tutorial about how to protect youself from being hacked...Well, but u can never know.

[kobra]

I have done all the steps from the tutorial about how to protect youself from being hacked

Do you mean this article?
http://www.zen-cart.com/wiki/index.p...ing_From_Hacks

If so you should have a fresh expanded distribution of your ZenCart version locally

And your server files FTP'd to a location on your local

You check/compare that mountain of files with a diff tool like winmerge

Look for any files that are not in the distribution

[Ms_X]

Thanks for the link and advice, I will do so.

I used this article:

https://www.zen-cart.com/tutorials/index.php?article=73

and I have latest version of Zen cart(just for the info)

So if i see anything different from what i have locally,I should delete it?

[kobra]

I can only suggest that tou follow ALL the steps

Additionally run a web based virus scanner on your local

If they have hacked you locally to gain credentials, you need to stop that before making any changes to passwords

[Ms_X]

I will do so. where can I find web based virus scanner ?I have Norton installed,regular virus scans do not show anything but tracing cookies.

[Website Rob]

Index of /

* _README_
* cgi-bin/
* favicon.ico

Are you saying this is all that is within your Hosting account?

If yes, you have a much bigger problem as it could your site being hacked through a Server vulnerability. Ask your Hoster if any other accounts on the same Server as your account are also experiencing problems. And have you changed your FTP password?

[Ms_X]

I will ask them about others, but when I suggested that I might be hacked they just said check all your files and they said servers themselves are secure.. When I look at my file manager from CPanel, all the files are there,so I don't know... The problem is, yesterday they restored one of my back uos, site worked for few hours and then again started to like this. And I have not change a single thing in the script,just deleted 2 products from catalogue (using admin). So I guess I will need to reset all my account then.

[Website Rob]

It stands to reason that if your site was hacked and then resorted from backups on the Server, the backups could also include any previous hacks.

You should be keeping your own backups. That way you know they are safe.