Blank payment option/checkout_payment page (step2 page)

I have spent all day with my hosting co and uploading pages to figure why my customers can't get further than adding to the cart, choosing shipping option and then hit continue and get a blank page. My last order was on 5/27/12 so whatever happened I'm assuming was after that. My hosting company sees nothing, has tried disabling mod_security, and can't help. I have made no changes to cause the problem although now I have uploaded all my checkout pages from a back up and still receiving blank page. I checked for blank lines as was a fix for others. I cannot find anything in the faq or tutorials. Could I have been hacked? Inmotionhosting (my host) does not see anything. my site is childrensclocks.com I have been using zencart since 2009 and have always been able to fix things. Can someone please help?

What version of Zen Cart are you using?

Clean install or an Upgrade?

What debug log information is in the:
/cache

directory? Check your newset files and see what it reports about the error ...

it says v1.3.9a I know I originally installed 1.3.8 I thought I had upgraded to 1.3.9h but it doesn't say so.
I did not see errors in the cache earlier but now I see this: [29-May-2012 16:26:41] PHP Parse error: syntax error, unexpected T_VARIABLE in /home/childr10/public_html/includes/modules/payment/authorizenet_aim.php on line 296
About 10 of them but that could be my hosting co. and me testing.
Also now I notice I can't edit some orders in the admin. a blank page showing there on the last order (5/27), but I can on the one before (5/25), and then blank on the one before that 5/24).
I have no new files. I haven't done anything to the site since April.

You have been hacked. This means your whole store is compromised. Have a look in the module and search for and emailing script. The telltale sign is checking for .com or .net as there should not be any of that in there. You are getting a white screen thankfully because there is a syntax error for the script insertion.

You will also need to follow the recovering from hacks guidelines located here:
http://www.zen-cart.com/wiki/index.php/Recovering_From_Hacks

What module am I checking

I prematurely posted that... I wanted to add that you are searching for an email address with .com or .net. This will be in the authorizenet.php or the authorizenet_aim.php (check both) as they like to insert their scripts into them. Have your host run a shell script scan with whatever AV they use. Check the logs and get as much info about who did it. Your host will be able to help.

Can I just replace those files with a back up copy?

A better approach would be: http://www.zen-cart.com/wiki/index.php/Recovering_From_Hacks

That will fix the payment module, but the point is if they inserted code into your files that means they have either full control of your hosting account via a shell script or have full access via control panel or server etc. You need to have your host scan and remove the bad and replace all usernames and passwords. You will then need to follow the recovering from hacks as I suggested.

$to = "cczencart####################"
$from = "[email protected]";
I see these 2 addresses with .com in the module. Do they look right? I have no "orderan" web address that I know of.

I didn't post those ## signs It was suppose to read cczencart####################

Oh God, I keep typing one thing and it prints another

finding those in there proves that there was a hack insertion and validates what I say. Replace those files with originals and set them to permissions 444 and then do your cleanup as outlined.

Replace with originals???? Can I replace them with the new version of zencart 150?

No, you must replace with 1.3.9 files

Okay, I found my original files, replaced those modules and the payment pages are now showing. I contacted my host and requested the shell script scan and tomorrow I will proceed with the hacking recovery. Thank you!