All categories and products are gone

[polarduality]

Hello,

I am working on a site that was working fine up intil maybe an hour ago.
I got a call from my client telling me that all the products dissapeared.

I just checked and all the categories and products are gone. I am wondering if someone hacked the site. This site isn't even live yet.

I really have no idea where to start investigating want went wrong.

User error? I don't think my client could have deleted ALL the categories by accident unless there is a button to delete everything at the same time.
Everything else on the site is intact.

Is there a log I can check for activity?

Any help in resolving this issue would be greatly appreciated.

[Kim]

Look at the database via phpMyAdmin, is there information in the tables? What does the host have to say?

[polarduality]

I was on the phone with GoDaddy but they didn't find anything. Just in case I'm going to change the admin folder which I was waiting to do right before launch. Now I know better.

I have a last hope that I'll be able to restore the database.
Coincidentally, last night I installed the SQL backup utility and I was testing it.
I downloaded a backup successfully but when I tried testing the restore process on a separate store, it didn't work. I just viewed the sql file and it looks good so my last hope is to import it through phpmyadmin.

[polarduality]

I just noticed this at the end of the sql file

<div class="systemError">2013 Lost connection to MySQL server during query<br />in:<br />[select count(*) as total from sessions where sesskey = '3696b2ded4103e85d1c0d75700172a42']<br />If you were entering information, press the BACK button in your browser and re-check the information you had entered to be sure you left no blank fields.<br /></div><br />
<b>Warning</b>:  Unknown(): A session is active. You cannot change the session module's ini settings at this time. in <b>Unknown</b> on line <b>0</b><br />

[DrByte]

Surely you have posted this in the potential-hacks area for a reason.
Have you followed the recommended steps for recovering from hacks and protecting yourself from intrusion?
See link at the top of this section, or here, or in the wiki:
http://www.zen-cart.com/wiki/index.p...ing_From_Hacks

[polarduality]

I just saw the admin_activity_log with phpmyadmin and I see where the categories were deleted by admin ID 3. I shouldn't have deleted the 2 other admin accounts to see which one was admin 3.

The categories were definitely removed through the zen admin.

7801 2006-09-30 16:20:46 3 categories.php cPath=5_38_43&cID=44&action=delete_category& 69.106.207.151
7802 2006-09-30 16:20:49 3 categories.php action=delete_category_confirm&cPath=5_38_43& 69.106.207.151
7803 2006-09-30 16:20:51 3 categories.php cPath=5_38_43& 69.106.207.151
7804 2006-09-30 16:21:13 3 categories.php cPath=5_38&cID=43& 69.106.207.151
7805 2006-09-30 16:21:20 3 categories.php cPath=5_38_43& 69.106.207.151
7806 2006-09-30 16:21:29 3 categories.php cPath=5_38_43&action=new_category& 69.106.207.151
7807 2006-09-30 16:22:03 3 categories.php cPath=5_38_43& 69.106.207.151
7808 2006-09-30 16:22:22 3 categories.php cPath=5_38_43&action=new_category& 69.106.207.151
7809 2006-09-30 16:23:29 3 categories.php cPath=5_38_43& 69.106.207.151
7810 2006-09-30 16:24:15 3 categories.php cPath=5_38_43&cID=44&action=delete_category& 69.106.207.151
7811 2006-09-30 16:24:26 3 categories.php action=delete_category_confirm&cPath=5_38_43& 69.106.207.151
7812 2006-09-30 16:24:31 3 categories.php action=delete_category_confirm&cPath=5_38_43& 69.106.207.151
7813 2006-09-30 16:24:33 3 categories.php cPath=5_38_43& 69.106.207.151
7814 2006-09-30 16:27:31 3 categories.php cPath=5_38_43&cID=44&action=delete_category& 69.106.207.151
7815 2006-09-30 16:27:38 3 categories.php cPath=5_38_43& 69.106.207.151

[DrByte]

Have you reported the issue to your host? What are they saying? Are they indicating whether there may have been some issues recently, either with the mailserver your account is on, or perhaps even other hacks into other accounts on the same server?

Someone stealing your admin password and logging in and deleting things is *not* necessarily a "hack" attempt. That would be theft or vandalism.


I'm not seeing this issue as being a hack indicating a vulnerability in the code.


Then again, you haven't indicated what measures you've taken to secure your site etc as per the guides published for that purpose.

[polarduality]

My host is separate from my client's host.
I didn't contact them when I saw the weird e-mail thing.

I did contact GoDaddy, my client's host and they said they couldn't find anything odd.

I took all the recommended security measures except for the renaming of the admin folder which I was going to do before going live.

I also don't think it was a code vulnerability.

[polarduality]

this is so frustrating. *pulls hair
I'm trying to import the 1.13MB sql file and it keeps timing out!

[polarduality]

would it be possible to extract the category and product data from the sql file and run that data in the query window?