All categories and products are gone

Hello,

I am working on a site that was working fine up intil maybe an hour ago.
I got a call from my client telling me that all the products dissapeared.

I just checked and all the categories and products are gone. I am wondering if someone hacked the site. This site isn't even live yet.

I really have no idea where to start investigating want went wrong.

User error? I don't think my client could have deleted ALL the categories by accident unless there is a button to delete everything at the same time.
Everything else on the site is intact.

Is there a log I can check for activity?

Any help in resolving this issue would be greatly appreciated.

Look at the database via phpMyAdmin, is there information in the tables? What does the host have to say?

I was on the phone with GoDaddy but they didn't find anything. Just in case I'm going to change the admin folder which I was waiting to do right before launch. Now I know better.

I have a last hope that I'll be able to restore the database.
Coincidentally, last night I installed the SQL backup utility and I was testing it.
I downloaded a backup successfully but when I tried testing the restore process on a separate store, it didn't work. I just viewed the sql file and it looks good so my last hope is to import it through phpmyadmin.

I just noticed this at the end of the sql file

<div class="systemError">2013 Lost connection to MySQL server during query<br />in:<br />[select count(*) as total from sessions where sesskey = '3696b2ded4103e85d1c0d75700172a42']<br />If you were entering information, press the BACK button in your browser and re-check the information you had entered to be sure you left no blank fields.<br /></div><br />
<b>Warning</b>:  Unknown(): A session is active. You cannot change the session module's ini settings at this time. in <b>Unknown</b> on line <b>0</b><br />

Surely you have posted this in the potential-hacks area for a reason.
Have you followed the recommended steps for recovering from hacks and protecting yourself from intrusion?
See link at the top of this section, or here, or in the wiki:
http://www.zen-cart.com/wiki/index.php/Recovering_From_Hacks

I just saw the admin_activity_log with phpmyadmin and I see where the categories were deleted by admin ID 3. I shouldn't have deleted the 2 other admin accounts to see which one was admin 3.

The categories were definitely removed through the zen admin.

7801 2006-09-30 16:20:46 3 categories.php cPath=5_38_43&cID=44&action=delete_category& 69.106.207.151
7802 2006-09-30 16:20:49 3 categories.php action=delete_category_confirm&cPath=5_38_43& 69.106.207.151
7803 2006-09-30 16:20:51 3 categories.php cPath=5_38_43& 69.106.207.151
7804 2006-09-30 16:21:13 3 categories.php cPath=5_38&cID=43& 69.106.207.151
7805 2006-09-30 16:21:20 3 categories.php cPath=5_38_43& 69.106.207.151
7806 2006-09-30 16:21:29 3 categories.php cPath=5_38_43&action=new_category& 69.106.207.151
7807 2006-09-30 16:22:03 3 categories.php cPath=5_38_43& 69.106.207.151
7808 2006-09-30 16:22:22 3 categories.php cPath=5_38_43&action=new_category& 69.106.207.151
7809 2006-09-30 16:23:29 3 categories.php cPath=5_38_43& 69.106.207.151
7810 2006-09-30 16:24:15 3 categories.php cPath=5_38_43&cID=44&action=delete_category& 69.106.207.151
7811 2006-09-30 16:24:26 3 categories.php action=delete_category_confirm&cPath=5_38_43& 69.106.207.151
7812 2006-09-30 16:24:31 3 categories.php action=delete_category_confirm&cPath=5_38_43& 69.106.207.151
7813 2006-09-30 16:24:33 3 categories.php cPath=5_38_43& 69.106.207.151
7814 2006-09-30 16:27:31 3 categories.php cPath=5_38_43&cID=44&action=delete_category& 69.106.207.151
7815 2006-09-30 16:27:38 3 categories.php cPath=5_38_43& 69.106.207.151

Look in your back up for the Admins.

69.106.207.151 Location: United States [City: Los Angeles, California]
adsl-69-106-207-151.dsl.irvnca.pacbell.net

Do you have a older database backup in which you could look up the name of admin #3 ?

I just looked in the backup and admin 3 was an account I created for my client but I hadn't given him the login info yet.

I need to verify if that is or isn't his ip address.
If it isn't then it was definitely a hack.

btw,

I am trying to import my backup but it keeps timing out.
The largest part of the sql file is the admin activity log. Can I remove that whole section?

I am now wondering if I got hacked.
My e-mail address was setup for that admin account.

Yesterday when I went into Outlook, it began to download about a month or two worth of old email messages AGAIN. emails that I already had and some that I had deleted.

Have you reported the issue to your host? What are they saying? Are they indicating whether there may have been some issues recently, either with the mailserver your account is on, or perhaps even other hacks into other accounts on the same server?

Someone stealing your admin password and logging in and deleting things is not necessarily a "hack" attempt. That would be theft or vandalism.

I'm not seeing this issue as being a hack indicating a vulnerability in the code.

Then again, you haven't indicated what measures you've taken to secure your site etc as per the guides published for that purpose.

My host is separate from my client's host.
I didn't contact them when I saw the weird e-mail thing.

I did contact GoDaddy, my client's host and they said they couldn't find anything odd.

I took all the recommended security measures except for the renaming of the admin folder which I was going to do before going live.

I also don't think it was a code vulnerability.

this is so frustrating. *pulls hair
I'm trying to import the 1.13MB sql file and it keeps timing out!

would it be possible to extract the category and product data from the sql file and run that data in the query window?

Have you telnet access to your site?

I'm not sure about that.
is it something I can setup?

QUOTE:

I am trying to import my backup but it keeps timing out.
The largest part of the sql file is the admin activity log. Can I remove that whole section?

Yes, you can.
You can also skip the email_history table contents if you don't mind losing that data too.
Both of those take up substantial space.

PS: For GoDaddy hosting, it's highly unlikely you'll have access to any sort of telnet service, unless you are paying for premium hosting services.

I tried removing the admin log but it still timed out.

Shoould I be deleting starting from

--
-- Dumping data for table admin_activity_log

?

I tried to run small sections at a time but then it comes back with this error.

Error
SQL query:

/*!40000 ALTER TABLE categories DISABLE KEYS */;

MySQL said:

#1065 - Query was empty

I only really want the categories and product data.
I don't care about anything else.There is no customer data yet because the site is still under construction.

I just checked my admin logs again and the user that deleted the categories IS the one I gave my client info for.

*sigh

It is really looking like user error now. I talked to the lady that is using that admin account and all she said was that she tried to add a new product and the system asked her to create a category.

If the IP is my client's IP then it was definitely them who caused this whole thing. I just don't see HOW they would have deleted and confirmed 5 different categories without realizing what they were doing.