weird bug : very specific cache file constantly being rewritten... for unknown reason

[David Lafontaine]

Hi!

I need help with a bug in my store i've been trying to track down for some time already.

I've tracked the main source of the problem (but not its cause!) to a very specific file :

• The file - public_html/var/cache/prod/smarty/compile/07/8a/84/078a84f8a8b1ae87b36bbcebcc77937e82222561_2.file.payment.tpl.php seems to be constantly touched or rewritten (about every few seconds if not more often, according to its last modified date).
• The last modified date of the file often lags by a few minutes (still updates almost every second, but to a date a few minutes behind the actual current time). I'm also believe i saw it once with a date a few minutes in the future (not certain though, only happened once so far!)
• The file contains the cached version of the final checkout step (payment step) template.
• None of the checkout templates (or any other templates for that matter) have been modified recently.
• I strongly suspect the file is being rewritten (or at least touched) on every visit to the store! (to ANY page, including the back-end, and not only when the checkout page is visited).
  For info, there is a decent amount of traffic on my store, about 2000 - 3000 page views per day.
• Deleting the file stops it from being constantly rewritten (it gets generated again when a user actually visits the checkout payment step)

The worst issue is that once in a while, about a 3-8 times per day (possibly because the file is constantly being touched or rewritten), the file gets corrupted with a large amount of null characters, which completely breaks the payment step (which just won't load anymore for users), and so prevents new orders.
And somehow, once the file gets corrupted, it doesn't get regenerated automatically and stays broken until i clear the cache or manually delete it.

Any help or insight on this problem would be greatly appreciated!

Edit : added further details

Edited April 15 by David Lafontaine (see edit history)

[Prestashop Addict]

Hi, can you give the list of payment modules installed and activated on your site?

[Nickz]

On 4/15/2025 at 2:47 PM, David Lafontaine said:

constantly touched or rewritten (about every few seconds if not more often, according to its last modified date).

sounds like infected.

Look at your access stats.

[El Patron]

you been hacked....if  you are unable to solve then you will need to get agency,  or someone here to find  the hack...

 

the alternative is to create fresh install on say subdomain, then migrate your shop data,  re-install reputable  3rd party modules..theme

 

then you have a cleaned shop

 

and if anyone reads this, why does ps allow free and 3rd party unvetted modules to be listed on forum?  how many shops have been hacked through free modules? while others have to vet and list their modules on addons (not easy thing)..ps in all it's lack of wisdom allows unvetted free/paid 3rd party modules)?  

 

rant over for now

[yama]

On 4/17/2025 at 2:31 AM, El Patron said:

how many shops have been hacked through free modules?

how many shops have been hacked through paid modules?

[David Lafontaine]

UPDATE : my store was not hacked.

The problem came from a shipping module (Canada Post: Rates and Estimator by ZH Media) which was missing translations.

Somehow that caused the specific cache file to be rewritten on every request.

It took a long time to find the cause, but once i found it, just filling the missing translations for the module fixed the problem.