2

doodle-bag.com is no longer functioning, customers cannot complete their purchases, however I cannot login to our Magento account to diagnose the problem. Any help would be appreciated. Thanks.

2

It could be you shop is/was compromised at some point so you should carefully check Magento + Webserver settings for suspicious entries, modified files, new admin users etc.

You cannot trust your current shop installation if it was compromised. The ultimate way to go would be a new & clean setup of all files on a new host/vHost with the latest backup before you shop was compromised.

If this is not possible due to various reasons, you might check/do these things related to this issue:

Remove all detected changed/hacked files plus installed extensions

Even better: Do a clean (git) checkout from your development system with the lastest version. This will be the safest unless your dev/staging system hasn't been compromised also (which is not the case if you develop locally or in a protected environment).

Remove created backend admin accounts

Especially for SUPEE-5344, there will also be an admin account created in the backend. Remove all new/unnecessarry admin accounts.

Backup plan

Depending on your backup plan and strategy, you could maybe think about a rollback of your complete database.

Check file/folder permissions

Did you check your file/folder permissions? There's no need to run everything with 777 or as root user. Depending on your server configuration 400/500 can be enough. See documentation here.

Check server logs

Check your webservers access/error log to trace accessed sites and suspicious URLs. Maybe you find suspicious IP's to block on firewall level.

1

Those two symptoms make me think that your shop may be compromised:

  • customers cannot complete their purchases
  • I cannot login to our Magento account

On top of that, according to MageReport your shop is missing a lot of the last important security patches: https://www.magereport.com/scan/?s=http://www.doodle-bag.com/

My suggestions:

  • Disable your store for now by creating a maintenance.flag at the root folder of your webstore.
  • Apply all the last security patches, you can use the official doc as a good guide to do so: http://devdocs.magento.com/guides/m1x/other/ht_install-patches.html
  • Check the database admin_user table for any shady users that you think you have not created and delete them.
  • Recreate your admin user manually via SQL by using the following code snippet (don't forget to replace the names, email, username and password values): https://gist.github.com/tridungpham/7785460
  • Re enable your store by deleting the maintenance.flag previously created

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.