over 800 emails per hour

Hello!
Am enclosing email from our host server and my reply back because it seems as though yet again our Zen Cart at: http://kmegd.com has been hacked - this would make it about the 4th/5th time this has happened.

Can anyone tell me or give me instructions as to how we can make our zen cart more secure: please.

What seemed to be a simple email failure has now changed into something more serious.
Would appreciate any help/advice.
Thanking you.
Bridget

Hi!

Thank you for getting back to us, contents noted.

From what you are saying it seems as though our website (http://kmegd.com)
has been hacked again.
The reason for this assumption is that we have NEVER sent or tried to send
853 emails per hour from any of our kmegd.com email addresses.

kmegd.com website we are preparing now to upload our products with prices,
and it was only when we tried to send an email to ourselves from the
Contact Us page in our zen cart that we found that we had the errors and
could NOT send ourselves an email (therefore neither could any prospective
customer to us).

Is it at all possible to find out whether we have been hacked?

Last 4 digits: 5036

If kmegd.com has been hacked this is about the fourth time this has
happened to us.
So would appreciate more details.
Thanking you.
Bridget

Hello,

Thank you for contacting Support.

We apologize for any inconvenience this may have caused you. You have
tried to send the 853 messages per hour from one of your email address
@kmegd.com . This is the reason the email sending functionality of your
entire account 'kmegd' is blocked. Hence, you were unable to send the
emails.

There is nothing here to substantiate the idea that your site has been hacked. If it has, there will need to be a lot more detail supplied about the actual specifics of such evidence. Merely sending large amounts of email via Contact Us doesn't constitute hacking. That simply indicates that someone is abusing your Contact Us form for spamming. In itself that's not "hacking" (hacking is adding or altering the files on the website to make the site do something it isn't designed to do).

If you need to tighten down your Contact Us form by adding inconveniences which make it more difficult to abuse, you have a few choices:
a) add a CAPTCHA to it. There's a "Google ReCAPTCHA" plugin in the Plugins area, which will accomplish this easily.
b) optionally add a CSS-driven anti-spam capability. This could even co-exist with the captcha. There's a forum thread about "CSS Anti Spam" which shows exact steps to make the required coding changes for that.

You've said that you think you've been hacked, and multiple times. What has been the result of your self-assessment when doing a thorough cleanup following the official instructions on http://www.zen-cart.com/wiki/index.php/Recovering_From_Hacks ? What specific exploits or damages have you discovered during the cleanup?

As always, using the latest version of Zen Cart offers the greatest security protections. It would be prudent to put a plan in place to upgrade to the latest version.

Dear Dr Byte,
Appreciate your prompt reply, contents noted.
Following which we take your advice and think it appropriate that we get the new version v1.5.0 which is available for download.
I will also get the CAPTCHA as well.

Are there any tips that you can give me before I download the new version? would appreciate your comments.
It is nice to have a friend to advise in moments such as this.
Thanking you.
Bridget

Implementing the captcha in the short term is probably your smartest first step.

Upgrading is a project which needs to be carefully planned. In many ways it's rebuilding your site, but with the ability to see all the stuff you already customized so that it's quick and easy to re-implement on the new system. Approaching it from that mindset makes the process less daunting.

Instructions for upgrading can be found at www.zen-cart.com/upgrade
and in the /docs/ folder of each new version of Zen Cart.

Dear Dr Byte,

Thank you very much for your advice, have gone through to that link and printed out the instructions.
To answer your question about hacking; yes we were informed by our host server that we were hacked, and twice when trying to go on to the website there was a blank page!
However, Netfirms were very helpful, but I had to restart again for the Zen Cart meaning that I had to re-install.

Is there any way at all of making the whole site more secure?
Looking forward to your reply.
Thanking you for your help.
Bridget

If your site had been hacked (files altered by an intruder), then if a thorough cleanup wasn't done to remove any "back doors" they might have created (by adding additional files that didn't come with Zen Cart or by changing the content of those files) they could use those backdoors to regain access to your site and do new hacking. They might have done this in files that site in another place in your hosting account.

Or if they gained access to your site via a virus on your computer which records keystrokes, then they can keep coming back simply by looking at whatever the keystroke logger is sending them every time you login someplace.

Or if they gained access by snooping your internet activity and found you logging into FTP via the (typical) unsecure method of standard FTP over port 21 (instead of using SFTP protocol and another port, or instead of FTP with implicit SSL or FTP-over-TLS/SSL) then they could see your password shared across the internet in plain text, and use that to login to your site and mess around.
Information about more secure FTP access is covered in the /docs/ImplementationGuide.pdf file included in v1.5.0. Your host can give you more information on whether they support secure FTP and how to do that.

The key is finding out how they've gained access to your site in the first place. Your host has server logs which can reveal that information, but it's a big job to analyze those logs, even for them.

But if the only symptom you have as confirmation of being "hacked" is 800+ emails via Contact Us, then I'm still unconvinced that a hack has actually happened. That said, all the above safe-computing ideas are still VERY important to embrace.

Dear Dr Byte,

Thank you so much for your expert advice, really appreciate it.
what is the virus that records keystrokes and how would I overcome this?
FYI: I do use FTP for uploading and downloading files from the server, (FileZilla is the program have used it for years).
I would be interested in knowing about SFTP protocol, and I will ask Netfirms if they support a secure FTP.
I also use Google Chrome as my browser, and just go in the admin through that.

At the moment I have printed out the directions for downloading the upgrade, and am reading it through.
Once again thank you for your advice.
Regards
Bridget

A virus which could record keystrokes would be a "keylogger" or "keystroke logger". There are many variations of these, with different names. A good antivirus and antispyware tool can detect these.

The http://www.zen-cart.com/wiki/index.php/Recovering_From_Hacks article has been updated with some tips about SSL as well. And there's also the linked article about http://www.zen-cart.com/wiki/index.php/Important_Site_Security_Recommendations and http://www.zen-cart.com/content.php?56-how-do-i-enable-ssl-after-i-have-installed-zen-cart

Dear Dr Byte.
I do have antivirus and antispyware installed, however I am wondering what are the best software for this....

In the meantime I have plenty of questions to ask Netfirms, it's just a matter of waiting for their reply.
I appreciate you getting back to me so quickly.
Thanking you.
Bridget