My 1.7.8.2 site was hacked. Not sure what to do next?

[bnadauld]

Someone hacked my site and installed a quick pay paypal button on in the cart and has been directing payments to another email address.

Not sure what to do next?

 

I have taken down my site and changed all passwords

Im currently comparing a back-up of the ftp hacked site with a backup taken before the hack. Maybe this will be fruitless?

Is it best to start with a brand new bitmani instance of PS and then reimport my customer data and passwords... is prestashop manager the way to go about things?

Hope someone can help

Edited September 22, 2022 by bnadauld (see edit history)

[ps8modules]

hi
Oh yeah, you're out of luck.
You had problems with PS 1.6 before and now with 1.7.
A clean install is a reasonable solution.
But you have to pay attention to what modules you install, especially those that come from outside Prestashop Addons.
In the past, I also encountered a security hole in the one-page checkout, when the e-shop was hacked through the file upload field, even though the extension was disabled.

[ps8modules]

The fastest solution for transferring data from the database is to install a new Prestashop with the same version in the database itself and change only the table prefix. You can then copy the old tables to the new table via phpMyAdmin. And after copying, upgrade Prestashop to the latest version via the 1 Click Upgrade module.

[ps8modules]

Also check this topic

https://www.prestashop.com/forums/topic/1066989-prestashop-16123-trojan-paypal-form/#comment-3410586

[bnadauld]

26 minutes ago, 4you.software said:

The fastest solution for transferring data from the database is to install a new Prestashop with the same version in the database itself and change only the table prefix. You can then copy the old tables to the new table via phpMyAdmin. And after copying, upgrade Prestashop to the latest version via the 1 Click Upgrade module.

i actually did the upgrade to get rid of onepage checkout. The ps on the new store was the latest ps build at the time but that was 8 months ago.

Thanks for the help. can you elaborate on the bit where you said "in the database itself and change only the table prefix".

Will any hacker compromised code be in the database maybe i will use last weeks back up of the sql?

 

Edited September 22, 2022 by bnadauld (see edit history)

[ps8modules]

For example, the old eshop had the table prefix ps_ and the new installation will have the table prefix psnew_ for example.

[bnadauld]

When i do the import of the db on the new store do i leave the img dir blank and do an import of all my products via csv import. or move the img dir of the old store to the new store then Regenerate thumbnails?

Do i dl the sql file then in notepad++ do a find replace for prefix ps_ to replace with eg ps_access, ps_advice etc etc

 

Edited September 22, 2022 by bnadauld (see edit history)

[ps8modules]

If you import from csv, you can put a url link to the old img folder there, which you rename and leave everything to Presstashop Import. There are several ways.

[ps8modules]

If a clean installation, then without third-party modules. T8m, if you change the prefix in the sql file, you will import the module records, which is not good.

[bnadauld]

1 minute ago, 4you.software said:

If you import from csv, you can put a url link to the old img folder there, which you rename and leave everything to Presstashop Import. There are several ways.

then its 'just' a case of reredesigning the look of the site and add the modules?

[ps8modules]

Just now, bnadauld said:

then its 'just' a case of reredesigning the look of the site and add the modules?

Yes 😉

[bnadauld]

5 minutes ago, 4you.software said:

If a clean installation, then without third-party modules. T8m, if you change the prefix in the sql file, you will import the module records, which is not good.

sorry im a little confused now. Do i only copy in certain/some tables from the old store?

Edited September 22, 2022 by bnadauld (see edit history)

[ps8modules]

As I wrote, you need to be careful when installing modules that do not come from Prestashop Addons.

[ps8modules]

So again from the beginning.

1. In the old eshop, delete everything on FTP except the img folder.
Rename the img folder to img_old, for example.
Do not do anything with the database of the old eshop, leave it alone.

[ps8modules]

2. download version 1.7.8.2 from Prestashop and upload Prestashop to FTP

[ps8modules]

3. install a clean installation of Prestashop and on the database connection page enter the table prefix psnew_ and the same login as for the old, hacked eshop

[ps8modules]

4. after installing clean Prestashop, go to the database via phpMyAdmin

[ps8modules]

5. copy the tables with the prefix ps_ to psnew_
!!! ATTENTION, not all !!!

 

[ps8modules]

6. these are tables:

ps_address

all ps_carier*

all ps_cart*

all ps_category*

all ps_cms*

all ps_contact*

all ps_customer*

all ps_feature*

all ps_group*

all ps_homeslider*

......

Just skip the ps_configuration tables and others that are from modules.

Edited September 22, 2022 by 4you.software (see edit history)

[bnadauld]

then rename img_old dir back to img and regen thumbnails?

Edited September 22, 2022 by bnadauld (see edit history)

[ps8modules]

3 minutes ago, bnadauld said:

then rename img_old dir back to img and regen thumbnails?

Why do you want to regenerate thumbnails when they are already generated in the folder?

[ps8modules]

After a clean installation, delete the img folder and rename the old img_old folder to img.

[bnadauld]

Just now, 4you.software said:

Why do you want to regenerate thumbnails when they are already generated in the folder?

ok i understand. Thank you so much!

[ps8modules]

As I wrote, in the database you click, for example, on the ps_image table and in the top menu of phpMyAdmin you click on Editing.

[ps8modules]

In the open phpMyAdmin window, you will find the Copy table to (database.table) section.

[ps8modules]

change ps_image to psnew_image

Edited September 22, 2022 by 4you.software (see edit history)

[ps8modules]

It's simple and you'll have everything under control and you won't be transferring useless or damaged data.

[bnadauld]

I best get to work.

Thank you so much again!

Edited September 22, 2022 by bnadauld (see edit history)

[ps8modules]

I was happy to help and point in the right direction 🙃

[bnadauld]

42 minutes ago, 4you.software said:

6. these are tables:

ps_address

all ps_carier*

all ps_cart*

all ps_category*

all ps_cms*

all ps_contact*

all ps_customer*

all ps_feature*

all ps_group*

all ps_homeslider*

......

Just skip the ps_configuration tables and others that are from modules.

just one last question now im getting my head around it? if you dont mind?

Are these the only tables to copy over? so tables such as ps_image_shop, ps_page, ps_warehouse_shop need to be left as the newly installed shops tables.

Edited September 22, 2022 by bnadauld (see edit history)

[ps8modules]

No, copy too 😄

I didn't write all of them, the list would be long.
You have to go logically.
Say you want to transfer customers and orders.
So you copy the tables customer, cart, order ....

[bnadauld]

1 minute ago, 4you.software said:

No, copy too 😄

I didn't write all of them, the list would be long.
You have to go logically.
Say you want to transfer customers and orders.
So you copy the tables customer, cart, order ....

got it

thanks for persevering

[ps8modules]

It is also possible to create your own php script and do everything in the background. Unfortunately, I'm not at my computer yet to write a sample for you.

[bnadauld]

thats ok youve done more than enough!