All categories and products are gone

[polarduality]

Hello,

I am working on a site that was working fine up intil maybe an hour ago.
I got a call from my client telling me that all the products dissapeared.

I just checked and all the categories and products are gone. I am wondering if someone hacked the site. This site isn't even live yet.

I really have no idea where to start investigating want went wrong.

User error? I don't think my client could have deleted ALL the categories by accident unless there is a button to delete everything at the same time.
Everything else on the site is intact.

Is there a log I can check for activity?

Any help in resolving this issue would be greatly appreciated.

[Kim]

Look at the database via phpMyAdmin, is there information in the tables? What does the host have to say?

[polarduality]

I was on the phone with GoDaddy but they didn't find anything. Just in case I'm going to change the admin folder which I was waiting to do right before launch. Now I know better.

I have a last hope that I'll be able to restore the database.
Coincidentally, last night I installed the SQL backup utility and I was testing it.
I downloaded a backup successfully but when I tried testing the restore process on a separate store, it didn't work. I just viewed the sql file and it looks good so my last hope is to import it through phpmyadmin.

[polarduality]

I just noticed this at the end of the sql file

<div class="systemError">2013 Lost connection to MySQL server during query<br />in:<br />[select count(*) as total from sessions where sesskey = '3696b2ded4103e85d1c0d75700172a42']<br />If you were entering information, press the BACK button in your browser and re-check the information you had entered to be sure you left no blank fields.<br /></div><br />
<b>Warning</b>:  Unknown(): A session is active. You cannot change the session module's ini settings at this time. in <b>Unknown</b> on line <b>0</b><br />

[DrByte]

Surely you have posted this in the potential-hacks area for a reason.
Have you followed the recommended steps for recovering from hacks and protecting yourself from intrusion?
See link at the top of this section, or here, or in the wiki:
http://www.zen-cart.com/wiki/index.p...ing_From_Hacks

[polarduality]

I just saw the admin_activity_log with phpmyadmin and I see where the categories were deleted by admin ID 3. I shouldn't have deleted the 2 other admin accounts to see which one was admin 3.

The categories were definitely removed through the zen admin.

7801 2006-09-30 16:20:46 3 categories.php cPath=5_38_43&cID=44&action=delete_category& 69.106.207.151
7802 2006-09-30 16:20:49 3 categories.php action=delete_category_confirm&cPath=5_38_43& 69.106.207.151
7803 2006-09-30 16:20:51 3 categories.php cPath=5_38_43& 69.106.207.151
7804 2006-09-30 16:21:13 3 categories.php cPath=5_38&cID=43& 69.106.207.151
7805 2006-09-30 16:21:20 3 categories.php cPath=5_38_43& 69.106.207.151
7806 2006-09-30 16:21:29 3 categories.php cPath=5_38_43&action=new_category& 69.106.207.151
7807 2006-09-30 16:22:03 3 categories.php cPath=5_38_43& 69.106.207.151
7808 2006-09-30 16:22:22 3 categories.php cPath=5_38_43&action=new_category& 69.106.207.151
7809 2006-09-30 16:23:29 3 categories.php cPath=5_38_43& 69.106.207.151
7810 2006-09-30 16:24:15 3 categories.php cPath=5_38_43&cID=44&action=delete_category& 69.106.207.151
7811 2006-09-30 16:24:26 3 categories.php action=delete_category_confirm&cPath=5_38_43& 69.106.207.151
7812 2006-09-30 16:24:31 3 categories.php action=delete_category_confirm&cPath=5_38_43& 69.106.207.151
7813 2006-09-30 16:24:33 3 categories.php cPath=5_38_43& 69.106.207.151
7814 2006-09-30 16:27:31 3 categories.php cPath=5_38_43&cID=44&action=delete_category& 69.106.207.151
7815 2006-09-30 16:27:38 3 categories.php cPath=5_38_43& 69.106.207.151

[Kim]

Look in your back up for the Admins.

[DrByte]

69.106.207.151 Location: United States [City: Los Angeles, California]
adsl-69-106-207-151.dsl.irvnca.pacbell.net


Do you have a older database backup in which you could look up the name of admin #3 ?

[polarduality]

I just looked in the backup and admin 3 was an account I created for my client but I hadn't given him the login info yet.

I need to verify if that is or isn't his ip address.
If it isn't then it was definitely a hack.


btw,

I am trying to import my backup but it keeps timing out.
The largest part of the sql file is the admin activity log. Can I remove that whole section?

[polarduality]

I am now wondering if I got hacked.
My e-mail address was setup for that admin account.

Yesterday when I went into Outlook, it began to download about a month or two worth of old email messages AGAIN. emails that I already had and some that I had deleted.