Strange Checkout Error Check this if you want to pay with different payment method

[kerryanne]

Hi

I have recently installed the bendigo bank module for a client and all was working well.

Now all of a sudden on the checkout page, there is a credit card form and a check box stating "Check this if you want to pay with different payment method"

If I do not check the box I get an error message saying the card could not be processed and it diverts to the banks payment method.

If I do tick the box and press continue, the page reloads and I am given the Bendigo bank option.

Can anyone shed any light on why this may be happening?

The Bank module is the only one activated. I have tried activating others and the same thing happens on the others I activate are added to the list under the bendigo bank option.

Screen Shots below

[pgmarshall]

Unfortunately, you have been hacked - this is a fairly new hack - it basically tries to skim cc numbers and sends them to a third party ...

You must have left your filemanager or language manager behind - have you done any of the recent security patches? Have you locked down your admin? Have an .htaccess file? Read the wiki for more info.

Open templates/fallback/content/checkout_payment.tpl.php page and you will find some extra code which is sending the information. Do a file compare against the RC4 source code ...

Regards,

[kerryanne]

I have found the code, thank you so much for your reply!!
I've now found many links about how to make osc more safe.
One thing I am confused with though, thats the patches and updates.
If I have a store running 2.0.0 can I just patch to the latest version or do you have to do each one?

[pgmarshall]

Post your URL for the site (or PM it to me) and I will have a look.

I would definitely recommend an upgrade ... this hack seems to gaining momentum on older stores where the security patches have not been done.

The code will be in the checkout_payment.tpl.php file in your template folder or the fallback one ...

Regards,

[kerryanne]

Its happened again, cant believe it.

Trying to find out where they are getting in

[ridexbuilder]

Your time would be better spent closing doors, not analysing which window that you left open.

[pgmarshall]

Do you have .htaccess on your admin panel?

Have you removed File Manager and Language Manager?

Have you checked your server for extra files which you don't recognise?

Try installing Threat Monitor

Regards,

[kerryanne]

lol I am closing doors

Have done all the things suggested in the wiki and am right now installing site monitor, which isnt playing nicely.

[ridexbuilder]

Scan your PC(s) and change passwords, everywhere (particularly if a keylogger has been detected).

[kerryanne]

I've done that with my PC and advised my client to do the same, perhaps they didnt, will remind them again.