Prestashop site hacked and after restore cannot access front office nor the back office

[kayol10]

Hello everybody, after my site was hacked few hours ago and being asked 0,1 BTC (email address [email protected]) I have tried restoring prestashop site from an older backup but when I try to access the standard website or the admin/back office I am redirected to index.php

 

I try to access http://www.cosmeticepenet.com/admin123 and I am taken to http://www.cosmeticepenet.com/index.php

It happens the same for trying cosmeticepenet.com - will be redirected to http://www.cosmeticepenet.com/index.php

 

 

I have access to cpanel and I can run queries on the DB but I have no idea what I would need to check next in trying to get the site to work again.

Was reading some comments pointing out to .haccess on the main root folder but I only have 4 lines in that file and not really sure if I need to change anything.

Any advice is appreciated

 

And the message returned on the page is

 

This page isn’t working

www.cosmeticepenet.com redirected you too many times.

 

• Try clearing your cookies.

ERR_TOO_MANY_REDIRECTS

 

 

[Scully]

check your .htaccess file or post the content here.

And it is likely that some files in your backup might be compromized - and hence redirecting to somewhere they should not.

 

have you checked file modification timestamps? They can give a hint on compromized files. But they can also be compomized by false timestamps if cleverly made.

[Scully]

You also have to consider your database, database user and password as well as your salt and all your user passwords are insecure now.

 

Once hacked, getting database credentials is quite easy. Find out the way the injection/attack took place. Fix install accordingly or make a fresh installation and import your database after fresh install.

 

The redirect problem might be the smallest issue at the end.