White Screen - can still access admin - help appreciated

Hosting: Godaddy
Version: 1.5.0
php: 5.2 - with godaddy message that it is no longer supported - I am able to upgrade to 5.3 or 5.4
mysql: 5.0
site: https://www.sapphiresofmontana.com

White screen was brought to my attention by a customer on Jan. 28 - right before our biggest trade show. I can access admin without trouble.

I have searched the forum for the subject, and the errors, and none have my issue. I did search for various php files in places where they don't belong and did find and delete two. One of which was in the images folder - so it appears I have been "hacked". When contacting godaddy for support the tech did seem to think there was also a php in the webroot that appeared malicious and deleted it for me before I could get the information. The following errors occurred on the same date the site went white (in order):

[28-Jan-2016 06:49:39] PHP Fatal error: 1062:Duplicate entry 'a917gauafe3dq8oepu370q44a0' for key 1 :: insert into zen_sessions
values ('a917gauafe3dq8oepu370q44a0', '1453990419', 'c2VjdXJpdHlUb2tlbnxzOjMyOiI2OTE4ZTdjMTJiNTJmMWU1NTI4YzYyOGMwM2VkYzczOCI7Y3VzdG9tZXJzX2hvc3RfYWRkcmVzc3xzOjIxOiJiMTEwMDA5LnlzZS55YWhvby5uZXQiO2NhcnRJRHxzOjA6IiI7Y2FydHxPOjEyOiJzaG9wcGluZ0NhcnQiOjc6e3M6ODoiY29udGVudHMiO2E6MDp7fXM6NToidG90YWwiO2k6MDtzOjY6IndlaWdodCI7aTowO3M6MTI6ImNvbnRlbnRfdHlwZSI7YjowO3M6MTg6ImZyZWVfc2hpcHBpbmdfaXRlbSI7aTowO3M6MjA6ImZyZWVfc2hpcHBpbmdfd2VpZ2h0IjtpOjA7czoxOToiZnJlZV9zaGlwcGluZ19wcmljZSI7aTowO31uYXZpZ2F0aW9ufE86MTc6Im5hdmlnYXRpb25IaXN0b3J5IjoyOntzOjQ6InBhdGgiO2E6MTp7aTowO2E6NDp7czo0OiJwYWdlIjtzOjQ6InBhZ2UiO3M6NDoibW9kZSI7czo2OiJOT05TU0wiO3M6MzoiZ2V0IjthOjI6e3M6MjoiaWQiO3M6MjoiMjMiO3M6NToiemVuaWQiO3M6MjY6ImE5MTdnYXVhZmUzZHE4b2VwdTM3MHE0NGEwIjt9czo0OiJwb3N0IjthOjA6e319fXM6ODoic25hcHNob3QiO2E6MDp7fX1jaGVja192YWxpZHxzOjQ6InRydWUiO2xhbmd1YWdlfHM6NzoiZW5nbGlzaCI7bGFuZ3VhZ2VzX2lkfHM6MToiMSI7bGFuZ3VhZ2VzX2NvZGV8czoyOiJlbiI7Y3VycmVuY3l8czozOiJVU0QiO3RvZGF5X2lzfHM6MTA6IjIwMTYtMDEtMjgiO3VwZGF0ZUV4cGlyYXRpb25zfGI6MTtzZXNzaW9uX2NvdW50ZXJ8YjoxO2N1c3RvbWVyc19pcF9hZGRyZXNzfHM6MTM6IjY4LjE4MC4yMjguMzciOw==') in /home/content/45/9089245/html/includes/classes/db/mysql/query_factory.php on line 101

[28-Jan-2016 09:34:32] ERROR: Failed sending email to: "" <> with subject: "Website Inquiry from Sapphires of Montana" (failed validation)

[28-Jan-2016 10:49:40] PHP Fatal error: 1062:Duplicate entry 'qaegqcgpe70rta3332e0mad6n5' for key 1 :: insert into zen_sessions
values ('qaegqcgpe70rta3332e0mad6n5', '1454004820', 'c2VjdXJpdHlUb2tlbnxzOjMyOiIzY2ZhMDUxYjIxNDQ1ODNjOGQ0ZjViYzgwM2M2NTQ0MyI7Y3VzdG9tZXJzX2hvc3RfYWRkcmVzc3xzOjIwOiJzdGVhbWJvYXRzcHJpbmdzLm5ldCI7Y2FydElEfHM6MDoiIjtjYXJ0fE86MTI6InNob3BwaW5nQ2FydCI6Nzp7czo4OiJjb250ZW50cyI7YTowOnt9czo1OiJ0b3RhbCI7aTowO3M6Njoid2VpZ2h0IjtpOjA7czoxMjoiY29udGVudF90eXBlIjtiOjA7czoxODoiZnJlZV9zaGlwcGluZ19pdGVtIjtpOjA7czoyMDoiZnJlZV9zaGlwcGluZ193ZWlnaHQiO2k6MDtzOjE5OiJmcmVlX3NoaXBwaW5nX3ByaWNlIjtpOjA7fW5hdmlnYXRpb258TzoxNzoibmF2aWdhdGlvbkhpc3RvcnkiOjI6e3M6NDoicGF0aCI7YToxOntpOjA7YTo0OntzOjQ6InBhZ2UiO3M6NToiaW5kZXgiO3M6NDoibW9kZSI7czo2OiJOT05TU0wiO3M6MzoiZ2V0IjtzOjA6IiI7czo0OiJwb3N0IjthOjA6e319fXM6ODoic25hcHNob3QiO2E6MDp7fX1jaGVja192YWxpZHxzOjQ6InRydWUiO2xhbmd1YWdlfHM6NzoiZW5nbGlzaCI7bGFuZ3VhZ2VzX2lkfHM6MToiMSI7bGFuZ3VhZ2VzX2NvZGV8czoyOiJlbiI7Y3VycmVuY3l8czozOiJVU0QiO3RvZGF5X2lzfHM6MTA6IjIwMTYtMDEtMjgiO3VwZGF0ZUV4cGlyYXRpb25zfGI6MTtzZXNzaW9uX2NvdW50ZXJ8YjoxO2N1c3RvbWVyc19pcF9hZGRyZXNzfHM6MTQ6IjIwNC4xMC4yNTIuMTI5Ijs=') in /home/content/45/9089245/html/includes/classes/db/mysql/query_factory.php on line 101

I had actually installed an updated version of Zen-cart (godaddy auto install) a few months ago with the intention of updating the site and didn't get past the set up. I did delete that folder just in case it was possible it was part of the problem.

I am hoping to get the site working and secure to buy me time to upgrade (which will take a while as I am not a developer and will literally have to follow the directions one line at a time while googling each step)

Any and all help appreciated!

Lisa

Check and carefully implement this: https://www.zen-cart.com/wiki/index.php/Recovering_From_Hacks

A few more things:

1. ZC 1.5.0 is long outdated and should be upgraded to the latest ZC version
2. PHP 5.3 / 5.4 is no longer supported - see http://php.net/supported-versions.php
3. never use an auto installer, there are numerous posts advising against this practice
4. move to a host that supports PHP 5.6 / 7.0

Thanks Frank! I will go through the link and see what I can sort out. Regarding your four, very valid points:

1. ZC 1.5.0 is long outdated and should be upgraded to the latest ZC version - That was my intention... road to hell and all that!
2. PHP 5.3 / 5.4 is no longer supported - see http://php.net/supported-versions.php - thanks for the information
3. never use an auto installer, there are numerous posts advising against this practice - I didn't do this for the initial install - and won't now.
4. move to a host that supports PHP 5.6 / 7.0 - sigh - just renewed hosting.... I will see if they offer this - otherwise, any recommendations?

I think I need to hire someone... this is getting way out of my realm.

Lisa

Bonkycat:

Thanks Frank! I will go through the link and see what I can sort out. Regarding your four, very valid points:

1. ZC 1.5.0 is long outdated and should be upgraded to the latest ZC version - That was my intention... road to hell and all that!
2. PHP 5.3 / 5.4 is no longer supported - see http://php.net/supported-versions.php - thanks for the information
3. never use an auto installer, there are numerous posts advising against this practice - I didn't do this for the initial install - and won't now.
4. move to a host that supports PHP 5.6 / 7.0 - sigh - just renewed hosting.... I will see if they offer this - otherwise, any recommendations?

I think I need to hire someone... this is getting way out of my realm.

Lisa

Check PM

Any chance you have a db backup anywhere?

Easy fix if you do :)

twitchtoo:

Any chance you have a db backup anywhere?

Easy fix if you do :)

Wasn't that easy, I can assure you!

Found numerous files with malicious code, upgraded site to 1.5.4 and PHP version to 5.4 (max available on this server) - all good now.