Did OSC wreck my site...or did my webhost wreck it?

[Guest]

I've had ongoing problems with my webhost of several years ever since it was sold to...someone else.

 

A couple of months ago...my entire website, the public side AND admin...was inaccessible for 24-36 hours over a weekend.

 

I couldn't even fully load my webhost's home-page during that time. Meaning, I couldn't even create a support ticket to scream for help. This began on a Saturday. It ended late Sunday, the next day, and I did nothing. I was just happy to see my site working again.

 

Fast forward to the month of August. I don't know how many support tickets I've filled out in the last two weeks. I can't access Admin. I can't load Cpanel. The images on my homepage...and every other page...are not loading. Some do, some don't. Half of them are loading as little red x's.

 

Every time I write...they fix it. And, to be honest, they fix it fast. Within minutes. But...do I ever get an explanation as to what has happened? No. I get replies like....Fixed! Or...Try it now! And, yes...it's fixed.

 

Now...it's late Saturday night EST where I am. I've been a very lazy girl with my website this week. I'm just logging into Admin...when it works...and printing packing slips and updating orders from Processing to Shipped. In other words, I've installed nothing. I've edited no files whatsoever that could adversely affect my website. I've done...nothing.

 

The last time I had trouble with Admin...days ago...I went to mysite.com/admin and got the login box. Fine. I logged in and hit the button and all seemed well except...it hung. And nothing was going to happen. Next thing I know, I get a Yahoo search results screen for anything related to mysite.com/admin within their own search box. Not good.

 

I write the webhost. It's fixed in a few minutes. Do they tell me what happened? Of course not. I've learned this much over the last couple of weeks...webhosts will NEVER tell you WHAT is wrong, much less that it's THEIR FAULT to begin with...they just fix it.

 

Same thing with the support ticket about my images not loading. Fixed...within minutes. No explanation, just...try it now.

 

I wake up this morning to an email from a repeat buyer who says....I can't load your website. I'm getting some weird error message. That's it.

 

So...I go to my website and I see this:

 

Parse error: syntax error, unexpected T_STRING in /home/xxxxxx/public_html/xxxxxx/includes/languages/english/header_tags.php on line 16

 

Throwing some x's in there as I don't want to advertise my site. I'm thinking....ooh! Header Tags Controller! Good Lord! I installed that like...4 years ago! What's going on with THAT?

 

So, I attempt to login to mysite.com/cpanel and take a look at that file. The login box appears and takes my login just fine...seemingly...but Cpanel never loads. It just sits...and sits...and sits. So, I write the webhost.

 

I receive a timely reply...informing me that there is something wrong with the same tagline I have used for 3 years-plus on the homepage of my site. It has an apostrophe in it. The Internet's Largest Database of blah, blah, blah. I reply to that email and tell my webhost....funny...it's only been there for 3 years or more. I don't think that's it. I KNOW it's not it.

 

I get a swift reply back. They've 'restored' header_tags.php from a backup and I should now be able to access Cpanel. All done right?

 

Nope. I'm thinking...I really don't like this stupid line I created years ago anyways. It's too long, too wordy, too pretentious. I'll login to the Admin side of my site....where Header Tags are controlled anyway...and change it.

 

So, I go to mysite.com/admin and login. I click on My Store. Then I click on Header Tags at the bottom left corner of my screen. And I get hit with this:

 

Parse error: syntax error, unexpected T_CONSTANT_ENCAPSED_STRING in /home/xxxxxx/public_html/xxxxxxx/admin/includes/functions/header_tags.php on line 102

 

Now I'm thinking...what the hell is going on with Header Tags Controller? Geez, I've had that in the website for...years! No worries, no problems, it's been perfect for...years!

 

I write the webhost again. What do they do? They restore that file from a backup. And I can now access Header Tags from Admin...with one noticeable problem. There are no tags pre-filled anymore. Fortunately, those tags are still written to the languages/english file for that contrib and are appearing onscreen. But when I visit that field from Admin? Nothing.

 

On to the next problem. I load the public side of my site. Mysite.com if you will. There's a weird occurance of n n n n running across the screen. What are those n's? I didn't put them there! They weren't there yesterday!

 

Then, I have the Dynamenu installed. A replacement for the plain old Categories box which comes with OSC. Great contrib I installed a couple of years ago and have never had a problem with. It's not loading properly. Instead of showing the main categories with little clickable x's next to them to use to display the subcats underneath...the whole freaking list of main categories and subcategories is displayed.

 

Like, I've gone from a categories box which is 3 inches in length to a box which is scrolling for MILES down the screen with every main cat and subcat showing and no way to stop it.

 

In the meantime...I've gotten good and angry over this stuff and rifled off probably the nastiest, most aggressive and vulgar email in my life to the webhost. I did everything short of dropping the F-bomb in my letter. And I get another email...someone else at the webhosting company. They say this:

 

We are sorry, there was a problem with ownership of the files in /home/xxxxx/public_html/xxxxxx/includes/ directory after their restoration. We've changed the ownership to 'xxxx' user and the site is working ok now.

 

Please check and let us know if you need anything else.

 

Right. What does that mean? Honestly, what does that email reply MEAN? I didn't do anything. What are they fixing?

 

Well...everything is NOT okay. My website is a disaster. The categories box is scrolling for miles and I have little NNNNN characters at the top of my screen. These things were not happening yesterday, people!

 

They reply back to me with...we're looking into it. We'll keep you updated.

 

And there it comes. I get this:

 

Please check the file /home/xxxxxx/public_html/xx/includes/header_tags.php. It contains the following line at the end of the file:

 

echo '!-- EOF: Generated Meta Tags --' . "n";

 

That is why you see "n n n nn ". The daily backup of this file contains the same string and there is no such line in the weekly backup of this file. It was modifed on 29 Aug at 10:30.

 

August 29th was Friday, right? I did nothing but print packing slips and update orders to Shipped! And FURTHERMORE...I downloaded that Header Tags controller contrib again to take a look...and that line they reference, is part of the original install of the contrib! I deleted it for the heck of it and...nothing. After clearing cache, deleting history and temp files...I STILL have n n n n running across my screen.

 

And the Categories box? This is what I got out of them for that one:

 

We've checked daily, weekly and monthly backups of your site and there is no difference between current menu and menu in the backups. It's a programming issue and there is nothing wrong with server. Please check the source of your site or contact developers.

 

So....it's an OSC problem. Or...is it?

 

I'm asking for opinions, here. Is it a coincidence that my website is not loading properly AND I've had to contact them constantly for the last two weeks because I can't access this or that? IS it a coincidence?

 

Is my 4-5 year old installation of OSC imploding and dying before my very eyes or...is there something wicked going on within my webhosting?

 

How does one really KNOW that the problems they are experiencing are courtesy of their own webhost? I don't know what to do here. I can't fix something that I know I didn't break to begin with, you know? I have tons of contribs on this site. I am not new to OSC. I'm no programmer, but I'm no newbie, either. What would you do? What should I do? The webhost is content with playing dumb, it seems, and laying it all off on me or OSC. Funny how the website has been fine for years and all of a sudden...bad things are happening.

 

I've installed nothing lately. I can't even remember the last time I made a significant change to my website. I just create new listings and upload photos and pack and ship orders. What do you think? Do I have a problem webhost on my hands or what?

 

- Andrea

[lindsayanng]

well, first thing i would do is consider getting a new host. A host that is not available 24 hours for support (by phone or chat) and one whos OWN website has real down time is NOT worth paying for. That is just a given.

 

HOWEVER An unexpected T string error is a coding error and is probably NOT caused by your host. It COULD also not be caused by yourself if you know you didnt change those files recently (and as far as i know, they dont update on their own) So the other option is that you have been hacked. Which would change your coding. I am not too knowledgable on the subject, and am unsure how and why header tags would be a target or an opening.

 

With all of the issues you mentioned, like the files being shown as changed even though you didnt change them, some odd error showing code that you cant find.. ALL of that stuff sounds 100% like a hacker to me. I just wish i could tell you how to fix it. The best thing to do would be to, closedown your site for a while, restore an ENTIRE backup, including databases, upgrade your version of oscommerce, and learn how to lock it down.

[Guest]

Hi Lindsay,

 

You know...when the webhost informed me that my file had been changed on Aug 29th, I thought the same thing...

 

I've been hacked.

 

But...maybe it's just me and I'm being silly...I would think that if I had been hacked, my website would be redirecting to a porn site. The thumbnail images on my homepage would be replaced by, I dunno...naked bodies or something.

 

I find it hard to believe that a hacker would only do 'this much' damage. Honestly, the only way I'm cheering myself up right now is to look at it as merely 'cosmetic' damage. Weird little succession of n n n n on my screen. My categories box not loading properly. It's all...visual damage. Cosmetic damage.

 

The website is functioning in every other way. I got two orders in the middle of this nonsense going back and forth via email with the webhost. So, if it's a hacker...what a bad job, you know?

 

I appreciate your reply. I just can't believe this is a hack-job. A hacker would have done more damage than this, wouldn't they?

 

- Andrea

[Guest]

You may want to look here.

[lindsayanng]

hacks dont always have to be porn or show inappropriate things. Hackers can add code that you wont see that will phish for your customer's email address (without them entering it into a field) it will pull data regularly from your database and put it into their own - like customer information... hacking is NOT something that is adding or redirecting to another site.

 

You definitely were hacked, in my opinion.

 

oh yea, and the BEST hackers do it so that you dont realize its there until its too late. So no, they didnt do a bad job. they probably did a really GOOD job, which is why their code that they added looks like nnn n n nn instead of what it really is.

[Guest]

Good God, Leslie and Lindsay, you guys are scaring the carp out of me now.

 

Someone would want to hack my little old website? Geez, I don't even have a merchant account. No financial info to be found on my site. It's Google Checkout, PayPal and checks/money orders over here. No credit card info collected over here. Just...email addresses on file, really.

 

One question for you: should my webhost have a history of ip addresses that could have accessed Cpanel or Admin in recent weeks or days? It'd be nice to know who could have, and block their butts in the future.

 

Off to click around that scary list of links that Leslie threw my way, but...Thank You! Both of you!

 

- Andrea

[lindsayanng]

they probably didnt access your cpanel or admin, they just hacked your files directly most likely. You MIGHT be able to call your host and see what ip address that particular file was changed on. It is a scarey thing, and thats why there are so many security updates to oscommerce.. and they might not want credit card info, they could just be phishing for email addresses, phone numbers,e ct.. ya know, people PAY for usable email addresses and phone numbers. They can collect them and sell them.

 

There are MANY MANY reasons to hack a website.. and the smaller it is, the more likely it is to not have th eproper securities, which would make your little old site a PRIME target.

 

you will probably never find the person that hacked the site> the only thing you can do is revert back to an unhacked version (or re-upload a fresh install and re build) and then button down the hatches.

[germ]

The "n n n n" is coming from the meta tag generator.

 

The PHP code should have "\n" in it (somewhere), but it's been altered to just "n"

 

Editing with the osC File Manager will do that.

 

I cannot explain HOW it got edited, I can only point to the problem.

:blush:

[Guest]

Lindsay,

 

How could they hack my files without password and access to Cpanel or mysite.com/admin? I'm finding myself becoming really p***ed off and equally fascinated at the same time. LOL!

 

Hi Jim! I understand your post...you're basically telling me the same thing the webhost did, in a way, but...I have never touched those files since installing them years ago.

 

I must admit to you...I have always edited my site via Cpanel. I don't care if it's installing a contrib or uploading photos...I've never gone the FTP route. I learned a long time ago that as long as you're careful to check for blank white space...an empty line...at the bottom of the file before saving, you're good to go.

 

I checked that header tags file and knew immediately I had never visited it, because...if I had saved without checking...my cursor was going to be on a blank line at the end of that file...and it was. Any and all files I've ever visited or even edited previously...when I scroll down to the bottom before saving, which I always do....the cursor ends up next to the last line of code in that file.

 

I had to hit the back button and move my cursor up on the header_tags.php file before saving after just even looking at it. Funny how even a hack attempt wouldn't have left me with a file that never appeared to have been opened and visited before.

 

Now, I'm just sitting here thinking....I can't restore my site from the weekly backup of the 25th. The webhost offered it, but....my inventory will be a disaster. I sell things that are not plentiful and I restocked a good number of items this week. They're all tucked away and if I allow the webhost to do a 'restore' of sorts from the 25th, not only will all customers' orders be erased from the database within that time frame, but...my inventory...what's in and what's out...will be a disaster. I have over 3,000 items listed in the website.

 

I guess my big problem now is trying to figure out what files were altered in order to correct what are essentially crappy 'cosmetic' changes to the pages, mostly in the part of that damn categories box. What a mess that is unfolding onscreen. I appreciate all the help, guys!

 

- Andrea

[germ]

I figured YOU hadn't changed it.

 

I wasn't certain if you knew where they were coming from or not.

 

And editing with the osC File Manager is the only way I knew to get what you got!

:lol:

[lindsayanng]

Restoring the php files in your site shouldnt mess with your stock or databases at all. If all of your infomation is stored in the database, then uploading JUST the files that were hacked or just the php files should be FINE. although that is what i THINK should be the case, but i suggest reading into it more.

 

So you are soo long winded, i think i got lost, but you are agreeing that you probably got hacked since you didnt edit in the osc filemanager and you checked to see if there were any normal errors that would create this. Also, have you explained WHY the file was changed on the date that you didnt change anything.

[purplemartinart]

Just a thought, does your "little ol' site" have any competitors that market the same type of stuff. Might just be a malicious rival.

Just a thought... I'll be quiet now. :huh:

[Guest]

I'd also get a decent host. I always get told in detail what's going on and what is being changed. I wouldn't have it any other way.

[Guest]

Now, I'm just sitting here thinking....I can't restore my site from the weekly backup of the 25th. The webhost offered it, but....my inventory will be a disaster. I sell things that are not plentiful and I restocked a good number of items this week. They're all tucked away and if I allow the webhost to do a 'restore' of sorts from the 25th, not only will all customers' orders be erased from the database within that time frame, but...my inventory...what's in and what's out...will be a disaster. I have over 3,000 items listed in the website.

The backup files are not the same as a database backup. The backed files should be ok to restore.

 

A partner with itchy fingers can also cause problems that you aren't told about.

[Guest]

Firstly, I'd like to say Thank You to everyone that responded. Jim...you were right. The n n n n thing appearing on my screen had everything to do with the Header Tags Controller files that first threw the error messages and alerted me to all of this wickedness.

 

For some reason, all of the back slashes in front on those 'n's in the header_tags.php file were deleted. I replaced them all with '\n' and all was well with the world again...at least, as far as THAT problem goes. So, at least I no longer have some funky, distracting thing running across the top of my webpages now. Thank You for that.

 

Regarding your comment, Jim, about how that can happen when editing via Cpanel....I haven't touched any of the files related to Header Tags Controller in years. I swear. So...why did that happen? I have no idea.

 

Leslie...I wrote to the webhost this morning and asked very direct, specific questions about what their 'restore backup' would mean. I got a lousy answer. They cannot just restore the OSC files...whatever they can do involves a full-restore, including the database. Meaning, I get sent back in time missing orders, inventory totally screwed up, you name it. So, I said no to that mess.

 

I'm still stuck trying to repair my categories menu. I use the Dynamenu contrib. I downloaded it and installed it all again, and the damn thing STILL won't work. I'm getting a browser warning in the bottom left corner of my screen...one of those 'Done, but with errors' warnings whenever I load a page. I doubleclick on the message and all I get in the details box is 'object expected'...whatever that means.

 

Whatever has happened...the site is functioning. Orders are being placed and all seems well there. But, I'm downright mad over losing my Dynamenu and really have no way to troubleshoot it. I installed it anew and it still doesn't do what it should. Ugh. So, I'm temporarily back...hopefully...to using the plain old categories.php box that came with the software. That categories box is loading just fine and flagging no browser warnings at all.

 

Maybe I'll dream of what's wrong tonight and fix it ASAP in the morning. LOL.

 

- Andrea

[lindsayanng]

Ok. there is a stilla high possibility that your store was hacked. The fact that your files were changed, and the date shows a day that you KNOW you didnt change anything shows that someone, not you, accessed your files and changed them. That is not to be taken lightly.

 

Secondly, you HAVE to get a new host. Really, a host's support should have clear, technical answers. The fact that they told you that they can ONLY do a full restore which includes the database seems ridiculous, since they are two entirely separate things, and there is no reason one can not be done without the other.

[Guest]

I guess I'm still marveling at the prospect of being hacked.

 

I went to bed last night and thought...geez, didn't anyone really read what I said?

 

Weeks and months of can't access this...can't access that...pictures not loading...only to culminate in waking up on Saturday and finding a mess unfolding on my website.

 

This is the last email I received today from my webhost before I stopped replying and started trying to fix this mess myself. Copying and pasting here:

 

If we do a full backup restore the database will be replaced, but we can restore only a part of account, like only public_html (looks like this was already done). We can also put only a database backup somewhere for you to download it and restore only a part of it. Let us know what would you like us to do.

Notice the broken English; not exactly comforting to read this guy's reply.

 

And public_html was already restored, huh? That's news to me! I have never asked for anything to be restored, ever.

 

I don't know if I was hacked but...I don't know that I wasn't, either. The webhost also told me today...no one whatsoever accessed or edited files via Cpanel or FTP on Friday August 29th, the last day I'm sure everything was fine. Meaning, neither did I. What happened during the night? I have no idea.

 

I do know that I need to fix my website and THEN transfer files to a new webhost. That's all that's in my head now.

 

- Andrea

[lindsayanng]

Umm. did read what you wrote, but your long winded and things get lost. I did get the fact that you have been having issues, and 90% of them are likely to be your host (GET A NEW ONE ALRADY!) but there is NO REASON for your host to randomly open a file and make a change to that file. Your file manager clearly told you the last time that the file in question was changed was on a day that you never made any changes. Again, there is NO REASON for a host to do this. If they ARE going to make a change, it would either be by moving your ENTIRE site to a different server (which still wont result in a time stamp for a change) or they will contact you before they do so. But NEVER EVER will ANY host touch any type of code.

 

So, with that being said. Down time, lack of access to pages, no email, ALL of that is because of your host. Errors on your page are not. They are the cause of coding gone wrong, which again, a host will NEVER touch. They usually wont even tell you how to change your code to make it work better with their server, they prefer you do it on your own.

 

Now, what the guy was telling you was that yes, they can restore your files and your database separately. They said they already restored the public_html - that is the directory which SHOULD contain ALL of your catalog files, as well as other files you might have on there. That means that they already did a restore of your shopping cart.

 

I personally think that you should NOT try to work with these people to try to fix things. They might restore your backup of your database without even asking them, as they already did it with your public_html. I personally wouldn't risk it AT ALL. I had a host similar to them glob at. They were awful, they released things before i asked them to be released, they made changes without my request, and on and on. I HOPE you arent using them!! BUT if you hosts now, and take your issues to your new host, you might loose the backups on the server, but you will not have the risk of the host doing something detrimental to your site. You MIGHT be able to ask your host to send a hard copy of the most recent back ups so you can just back up the site yourself. (this is why you should ALWAYS back up your site often, even if not making any changes)

 

Once you get a new, reliable, host, you will have a LOT easier time trying to figure out what might be a host issue, and whats a coding issue.

 

If you want a suggestion for an AWESOME host, i would be happy to suggest one. i just cant mention the name here, i guess. But they have top notch 24hr LIVE PHONE SUPPORT and they are entirely based in Ohio, and you ALWAYS get a nice computer geek (like all of us) that is always willing to help. i actually found that the later at night you call, the better service you get because they might be bored or something. I had a guy go above and beyond and actually teach me things that had NOTHING to do with hosting. it was great.

[Guest]

Good Lord, and you call ME long-winded. LMAO!

 

I'm going to fix my website all by myself. And then I'm going to transfer the files to a new host...and get away from this mess. Happy Holiday!

 

- Andrea (in the shortest post she ever made, maybe...lol)

 

P.S.....my website does not reside in the public_html folder at all. That made his email even more interesting...

[Guest]

I guess I'm still marveling at the prospect of being hacked.

 

I went to bed last night and thought...geez, didn't anyone really read what I said?

 

Weeks and months of can't access this...can't access that...pictures not loading...only to culminate in waking up on Saturday and finding a mess unfolding on my website.

 

This is the last email I received today from my webhost before I stopped replying and started trying to fix this mess myself. Copying and pasting here:

 

If we do a full backup restore the database will be replaced, but we can restore only a part of account, like only public_html (looks like this was already done). We can also put only a database backup somewhere for you to download it and restore only a part of it. Let us know what would you like us to do.

Notice the broken English; not exactly comforting to read this guy's reply.

 

And public_html was already restored, huh? That's news to me! I have never asked for anything to be restored, ever.

 

I don't know if I was hacked but...I don't know that I wasn't, either. The webhost also told me today...no one whatsoever accessed or edited files via Cpanel or FTP on Friday August 29th, the last day I'm sure everything was fine. Meaning, neither did I. What happened during the night? I have no idea.

 

I do know that I need to fix my website and THEN transfer files to a new webhost. That's all that's in my head now.

 

- Andrea

 

We all read what you said. Why in God's name have you spent months doing this???? Why haven't you left them months ago??? Learn from this. Don't you have your original files on your system anyway? Back up your sql file as is, and get another host. While dns takes it's time to move your site address wise, get your site set up on the new server. Or get it set up first on the new host, then notify whoever you registered with your new dns servers. But do it. Don't wait any longer. You've waited way too long already. Getting it right on this hosts server may be an effort in futility.

[lindsayanng]

Long winded and detailed are who different things. Long winded means it takes more words than required to get across a point. Detailed is slightly different. my post was dertailing what you SHOULD do (in my opinion) and what is likely happening or going to happen. VERY different things. You posts are hard to read because there is a bunch of unnessecary info and comments, which might make for good editorial writing, but not so much on here, where people value their time - especially when its helping others.

 

I agree with Deb. You dont have to cancel one account before oyu get another. Start a second account on a new, better host. Then put your SAME website up on that new host.. then, when you feel comfortable, change the domain name over. If you registered the domain with the old host, you MIGHT want to consider changing the domain registration over to the new host as well. Thats what i did.

 

Just dont wait. learn from the MONTHS of anguish that didnt really NEED to happen.

[Guest]

Lindsay...relax. I was playing with you.

 

I will be switching webhosts shortly. This is the first and only webhost I've ever had. I have nothing to compare it to. No experience elsewhere. But, the writing is on the wall at this point. Too many problems, too many headaches and...it's time to go.

 

I need to fix my site first before I transfer files to another. So, I'm stuck in that now.

 

Help me out and diagnose why my Dynamenu isn't working. Other than that? Stop yelling at me.

 

Everyone have a nice Labor Day. Nighty, night!

 

- Andrea

[lindsayanng]

maybe you should relax. No one is yelling at you. the thing is, it feels like we are banging our head against the wall trying to talk to you. TWO people have told you its better to just move your site and try to fix it there, or ATLEAST have the broken version on BOTH incase your existing host screws up.

 

THEN they also told you about 10 different reasons they thought you were hacked but you still didnt want to believe it. Its just not sinking in.

 

I will tell you again, get a new host NOW or you will be sorry.

[Guest]

Leslie...I wrote to the webhost this morning and asked very direct, specific questions about what their 'restore backup' would mean. I got a lousy answer. They cannot just restore the OSC files...whatever they can do involves a full-restore, including the database. Meaning, I get sent back in time missing orders, inventory totally screwed up, you name it. So, I said no to that mess.

 

- Andrea

If you back up your db and save the backup file to your pc, you can use it after they restore?