Recovered from hack, now site is displaying incorrectly

Hi guys,

I've had a few issues with a site of one of my clients. The address is https://www.bryncethintradecentre.com.

Recently, it came up as suspicious in the Google search rankings, and it turns out that the site has been hacked. On further inspection I could see that all links pointed to another site, and that the admin wasn't working. On inspecting the files, I could see that an index.php had been created in every folder to facilitate this. I deleted the new files and uploaded a backup I had on disk, unfortunately, the site is no longer displaying properly...

The home page for example, has the words heading_title and text_greeting_guest at the top. Which file contains it so that I can change it?

Also, if you click a category with multiple products, for example peugeot, you have text_show, tabel_heading_image and table_heading price. Any ideas where I can find these? I am using the EZRed template, and Zen Cart version 1.3.8a.

Many thanks in advance for any help...

Looking at the source code, I can see that these words appear in the h1 and h2 settings, however they are not included on the css file from my template?

You should re-upload the entire directories for:

includes/languages/english/
and
includes/languages/english/YOUR_TEMPLATE/

Hi,

Thanks for the reply - I have done this, however I still have the problem. Similarly I cannot find wither of the phrases quoted within the files....

Thanks again...

Problem is fixed - the index.php file was missing from the language folder - I have reinstalled this and now all is well...

Many thanks

Just an FYI

Google DID identify the malicious software on 4/20 so you might do a reconsideration with Google to be safe.

Google is currently showing in clean, but you can still have issues with Google... a reconsideration request will let them know you have fixed it and resolve and indexing and ranking issues.

What happened when Google visited this site?

Of the 102 pages we tested on the site over the past 90 days, 1 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2009-05-02, and the last time suspicious content was found on this site was on 2009-04-20.

Malicious software includes 1 scripting exploit(s).

Malicious software is hosted on 1 domain(s), including 84.244.138.0/.

1 domain(s) appear to be functioning as intermediaries for distributing malware to visitors of this site, including 95.129.144.0/.

This site was hosted on 1 network(s) including AS31727 (NODE4).

~Melanie

Have already done this thanks :) And so far so good!