Payment was replaced by Hacker

[qiqiy_888]

My site is V1.6.1.  My payment was replaced by unknow credit card module. they collect our customers credit card info.

Please check that,  anyone can help ??

[qiqiy_888]

All my other payment methods were display:none; Important !

Customers can't find my payment method, only see this fake collect credit card info.

Please help !!!

[c64girl]

UnInstall the module or delete IT front FTP. Password the catalog od prestashop using cpanel or diretadmin. Use migration tool to copy orderem,products,users,static pages and use newer prestashop.

Edited May 5, 2023 by c64girl
a (see edit history)

[GIO.D.P.M.]

Hello.

I have the same problem.

  I can't see my payment methods.

What can I do to fix it?

[razaro]

There is a solution, (use google translate if needed)

this script removes main hack files but it also gives you list of edited files that may also have some encrypted code (mostly at end of files).

You need to open those files and remove code or if uncertain replace with original files.

 

Also explained here bit more

https://www.mediacom87.fr/en/how-to-prevent-hacking-on-prestashop-and-thirty-bees/

[qiqiy_888]

10 hours ago, razaro said:

There is a solution, (use google translate if needed)

this script removes main hack files but it also gives you list of edited files that may also have some encrypted code (mostly at end of files).

You need to open those files and remove code or if uncertain replace with original files.

 

Also explained here bit more

https://www.mediacom87.fr/en/how-to-prevent-hacking-on-prestashop-and-thirty-bees/

Thank you so much, i will check this.

[qiqiy_888]

12 hours ago, GIO.D.P.M. said:

Hello.

I have the same problem.

  I can't see my payment methods.

What can I do to fix it?

@razaro post is helpful. but i just change the tpl file at theme files : order-payment.tpl

i changed the id="HOOK_PAYMENT"  to id="HOOK_PAYMENT_*******"    the payment show now

i am not sure it can fix the problem, but now, our customers can see the payment method. 

[qiqiy_888]

19 hours ago, c64girl said:

UnInstall the module or delete IT front FTP. Password the catalog od prestashop using cpanel or diretadmin. Use migration tool to copy orderem,products,users,static pages and use newer prestashop.

Thank you for your suggestion

[razaro]

@qiqiy_888

Note that changing code in that file have no effect on hackers in general. They used code placed somewhere deep in you root folder and on multiple places that when called copies complete payment.tpl  and injects fake form. 

You should also check your hosting, if you are on Plesk there is ImunifyAV or 360 or maybe Clam Anti-Virus, with them you can scan files from hosting. Cleaner.php linked script, do find most of issues but some could slip.