help I'm being repeated hacked.

I was running version 1.3.9 when someone gained access to my shopfront and changed my payment options to paypal with altered details. I discovered it when I couldn't log in and had to reset the password. Previously I was using NAB_transact for payment.

I immediately switched over to version 1.5.6 as I had been working on setting up version 1.5.6 anyway, so was quickly able to switch to that. New Admin name, account name, passwords. By the evening someone had logged in with a new password as the logs show a password change. Although I was still able to log in with the previously set password. Once again they re-enabled paypal.

Normally the site runs from https://www.priority1design.com.au/shopfront but I've had to change the folder name on my server, effectively killing the shopfront. As its live I can't risk people placing an order for products and having payment go to the hacker.

I'm effectively out of business till I can solve this. I'm using a shared SSL.

I'd really appreciate some help with this as this can be disastrous for me.

Regards
Robert Accardi
Priority 1 Design

You need to find out how they're getting in and plug that hole.

It could be via other software on the server (such as a compromised Wordpress site, perhaps even in someone else's account other than yours),
Or it could be some hole they put into your store in the old version's files that is still on your server (leftover files, or things you carried forward into the new version),
Or in rare cases a database alteration they've made.

So, involving your hosting company is a good idea,
and so is a complete site-audit.

See https://docs.zen-cart.com/user/security/hacked/

Further to this issue a file comparison with a clean backup has revealed various nasty programs like
IndoXploit.php placed in the images folder. I don't think I locked my images folder properly after uploading images.
Also files in the EDITOR folder appear to have been added.

These are excellent discoveries.

After removing unauthorized content, be sure to monitor again frequently (suggest daily) over the next month, to see if anything shows up again anywhere .... ie: they've maybe put in multiple backdoors.

Also be sure to check database tables, especially address_format (the format strings), configuration (esp configuration_value), product_layout (configuration_value) for malicious or javascript content.

Thanks, I'm going to do a complete wipe of the server, and a fresh install with the latest zencart, and we'll see. Till then I'm out of business. Its all a bit scary to be honest as these are criminals I'm dealing who are intent on malicious acts. I'll update if anything further develops.