Items multiply in cart when added to cart, server error or timeout?

I have a problem with my website that came up recently. I its been runing fine for years and the only updates I do is for adding products.

Zen Cart 1.3.8a
Patch: 1::
Database Patch Level: 1.3.8
v1.3.8 [2009-04-23 13:34:44] (Fresh Installation)
v1.3.8 [2009-04-23 13:34:44] (Fresh Installation)
PHP Version 5.2.17
Server OS: Linux 2.6.18-238.19.1.el5PAE hosted by GoDaddy for the last 4+ years
Database server version : MySQL 5.0.96-log

The problem started to happen about May 16th or 17th 2013, when customers add items to cart they Always get a server error or time out "Internet Explorer cannot display the webpage"

it's a differnt message on Chrome and FireFox, but same result.

When the browser is Refreshed, the item QTY in cart multiplies many times ( I have seen QTY of 11)

when they go to check out on paypal , the process goes through and they are able to get back to the website to finich the checkout but when choosing shipping cost the Server errors out again, and again.

So far I have completly reloded the Website from a good backup and its still doing same thing.
I looked over the Database and i just dont have the knowledge to spot anything out of ordinary.

I called GoDaddy to see if they were messing with the server, they checked around for about 15 min. and said "No", they also checked CURL andsome other stuff that "wizzed above my head" and said it all looked good on their end.

Stuff I found:
I did find some "customer" making spam reviews over the last few weeks on about 30 products but those were never approved and I deleted them all and deleted his account.

found a 404.php file with wierd code:

$back_connect_c= " giberish code
$back_connect_p=" giberish code"
$bind_port_c=" giberish code"
$bind_port_p=" giberish code="

the rest of suspect tode is attached in jpg file

I removed the 404.php file but it made no difference.

I have searched here bt have found no one with similar cart problem.

Please help or suggest new thing to try.

please pm me if you want the link to the website, I dont want to advertize my problems too much :)

rcht

Sorry to be the bearer of bad news, but your site has been hacked.

You'll need to follow this link for cleanup instructions. There are NO SHORTCUTS.

http://www.zen-cart.com/wiki/index.php/Recovering_From_Hacks

Cheers
Rod

RodG:

Sorry to be the bearer of bad news, but your site has been hacked.

You'll need to follow this link for cleanup instructions. There are NO SHORTCUTS.

http://www.zen-cart.com/wiki/index.php/Recovering_From_Hacks

Cheers
Rod

That would be bad, but I already restored the website to a known working backup. why would it still do the same exact problem.

Please explain.

rcht

rcht:

That would be bad, but I already restored the website to a known working backup. why would it still do the same exact problem.

Please explain.

I guess I must be wrong then. Sorry about that.

Rod

RodG:

I guess I must be wrong then. Sorry about that.

Rod

When the website was created it was patched and admin was renamed.

I have ran rootkit remove software on the copied files from the website, but it did not find anything.
I also ran searches for any key words that would imply SQL injections. Again can't find a thing.

Compared code with really old 100% clean files and they are identical.

I will update if I find anything.

Is there no love fo 1.3.8 anymore?

rcht

rcht:

Is there no love fo 1.3.8 anymore?

None whatsoever. There was a period of several years where we had a great deal of sympathy and patience towards those that became a victim of this series of hacks. These days I think although most of us still feel bad for the people still being hacked with this version, at the same time, we think you've only got yourselves(s) to blame.

rcht:

I have ran rootkit remove software on the copied files from the website, but it did not find anything.

No surprises there. It wasn't a rootkit that was installed. It was a backdoor to your own account (at least that's what I can gather from the image you attached).

rcht:

I also ran searches for any key words that would imply SQL injections. Again can't find a thing

Exactly what and where are you looking though? I doubt that you are looking through the MySQL log files, which is where evidence of an SQL injection is most likely to be found. You almost certainly won't have access to these log file.

rcht:

Compared code with really old 100% clean files and they are identical.

How did you compare any newly added files against the 'really old 100% clean files'? This is where most people tend to screwup and/or take shortcuts in their recovery attempts. Many have have done more than just compare their files, they've copied all of their 'old' ones over to the server, replacing the newer (possibly hacked) ones, only to discover the hacker returns the next day. Their backdoor program, being a new file doesn't get replaced when copying the old ones, 'cos there's nothing to replace it/them with. These need to be manually identified and removed.

I'll try this again...

Sorry to be the bearer of bad news, but your site has been hacked.

You'll need to follow this link for cleanup instructions. There are NO SHORTCUTS.
http://www.zen-cart.com/wiki/index.p...ing_From_Hacks

Telling me/us what you have or haven't done doesn't change a thing. You have been hacked. The evidence is plain to see. Debating the matter isn't going to fix things.

OTOH, if your attempts to fix things involved following the instructions provided then you wouldn't be sitting here telling us that you've done all the right things but 'still have exactly the same problem'.

You can't have this both ways. You can either accept the fact you've been hacked, and follow those instructions TO THE LETTER, and get things working properly again, OR you can ask a 1000' questions how and why, and go through a couple of pointless motions that you think will help, but at the end of the day all we can really do is direct you back to recovery instructions.

Be kind to yourself, skip the how's and why's. Go straight for the fix. BTW, The backdoor itself doesn't explain the symptoms you are reporting, this is probably the result of the hacker messing something else up whilst inspecting your system. There is no way to know exactly what they've done, so trying to fix individual symptoms isn't an answer either. Again. NO SHORTCUTS.

Cheers
Rod

Rod, thanks for putting me on the right path.

I gave up trying to fix the 1.3.8a, swallowed my pride and just created a whole new site from scratch.

I also got rid of GD and jumped ship to HM for hosting.

I did do a clean sandbox install from file downloaded here and uploded my DB via SQL PHP admin, upgraded the database to be compatible.

I did however run into some problems with my CSS

The old website had a custom CSS that I designed and I had a local Web Design company apply to zen cart. I was able to load it onto a new install but for some reason my Category Buttons do not show up.

In Layout box controller I had 2 MISSING sideboxes one of them being the categories sidbox.
I found that missing categories Sidebox module and copied it from the old website backup that was part of that custom CSS but after loading it it screws up the web page completly when I turned it ON, and all I can see is the Header and Footer image.

Attached images are of what it should look like, and what it looks like now when OFF.

BTW the missing sidebox for 'tell a friend' looked the same on the Categories line below untill i uploaded the side box module. now after theupload some to the text has turned red. Do you know why it turned red?

Thank you againg for your time.

rcht

rcht:

I did however run into some problems with my CSS

From the sounds of it, you've done remarkably well. I didn't want to scare you any more than needed, but many people seem to have a problem getting this far.

rcht:

The old website had a custom CSS that I designed and I had a local Web Design company apply to zen cart. I was able to load it onto a new install but for some reason my Category Buttons do not show up.

This, like many/most other template/theme/formatting output problems are often very difficult to resolve without access to the site. I/we will help in whatever way we can though.

rcht:

In Layout box controller I had 2 MISSING sideboxes one of them being the categories sidbox.
I found that missing categories Sidebox module and copied it from the old website backup that was part of that custom CSS but after loading it it screws up the web page completly when I turned it ON, and all I can see is the Header and Footer image.

It is quite possible/probable that these sideboxes aren't compatible with the updated code. My suggestion here is 1stly, remove them again so that the site is back to being functional, then have a search through the plugins section of this site to see if you can find an updated version of the same module. Most of the more popular/useful modules from the old versions have already been updated.

rcht:

BTW the missing sidebox for 'tell a friend' looked the same on the Categories line below untill i uploaded the side box module. now after theupload some to the text has
turned red. Do you know why it turned red?

It looks like a file may be missing (or unreadable), but this is little more than a guess.

I assume you had no problems retaining all of your customer and products data? (with all my upgrades, the loss of this is always my greatest fear/concern).
Everything else can be replicated or replaced :)

Cheers
Rod.

RodG:

From the sounds of it, you've done remarkably well. I didn't want to scare you any more than needed, but many people seem to have a problem getting this far.

This, like many/most other template/theme/formatting output problems are often very difficult to resolve without access to the site. I/we will help in whatever way we can though.

It is quite possible/probable that these sideboxes aren't compatible with the updated code. My suggestion here is 1stly, remove them again so that the site is back to being functional, then have a search through the plugins section of this site to see if you can find an updated version of the same module. Most of the more popular/useful modules from the old versions have already been updated.

It looks like a file may be missing (or unreadable), but this is little more than a guess.

I assume you had no problems retaining all of your customer and products data? (with all my upgrades, the loss of this is always my greatest fear/concern).
Everything else can be replicated or replaced :)

Cheers
Rod.

Thank you again, I did have some issues with DB but was able to work out everything as far as I can tell. All sales order history , products, etc.. is where it belongs.

I will look into the CSS again and try to work it out, if not I will call on my local web designer and have them update that part of it.

Thank you again.

rcht