Short answers to your 1, 2, 3, 4 are yes, none, no, yes. Good on Linux with php.exe 5.3.27 but your support is not being entirely helpful (granted, it is at least alert to protecting the server). Which is your host (via PM if you wish)?
(1) In the /catalog/ tree there will be model/, controller/, language/, and view/theme/template/, each much the same array of subdirectories. Those subdirectories contain families of like-named files, such as ___.php and in the instance of template/ ___.tpl, such as product.php and product.tpl files. ONE of your product.php files was renamed, specifically your catalog/controller/product/product.php file of the set. That put an axe through your product displays. Your products and categories are still in your database.
(2) Pull up or download anew your version's .zip file, and from inside its /upload/ directory send back up FRESH copies of all of your several product.php files, one by one to where they individually belong. That will replace the renamed one, catalog/controller/product/product.php, with a known good one. Delete the bad file, it can be found, renamed, and reactivated if intrusion is still active! Support apparently did not appreciate the ease of doing that.
(3) There may have been something odd in your /download/ directory. If so, then what your support did not understand, apparently, is that /download/ can be invaded independently of OC versions, it can occur in any version, and that intrusion does not necessarily even occur via OC itself, such as where a whereami.cgi file (used in certain blogs, including wordpress) invites intrusion and ability to move through the disc tree via http in a browser. The vulnerabilities after intrusion (by whatever means entry may have been gained) work in several ways, including as seen in
http://forum.opencart.com/viewtopic.php ... 60#p440953 and
http://forum.opencart.com/viewtopic.php ... 60#p453513 among others.
(4) Delete anything odd that might be left in your /download/ directory. Obtain MarketInSG's free extension to protect that directory (it requires vqmod, install the latest version, and the one for OC, if you need to do so) -- read his
http://forum.opencart.com/viewtopic.php ... 20#p403255 before you download and install (by simply uploading it) his
http://forum.opencart.com/download/file.php?id=16828.
(5) Ensure that your directories are 755 and your files are 644. You can use FileZilla Client to chmod the numbers in two passes, 755 all directories and then 644 all files, each time recursing through subdirectories. Shift-Click at least two files in the root, right-click to reset numbers, choose all of which, and to recurse. Each pass will take several minutes. Be alert to any 777 that you cannot reset; 777 gives all rights to owner, system, and complete strangers. Be alert to any .dirname/ (with DOT) directories, especially that are 777. Let 777 guide your eye. Look for odd executable files such as default.php, grocery.php (no kidding), etc., those can be extremely vicious hacking consoles, thus far in the ranges of about 29 kb to 34 kb and 75 kb to 79 kb. Such consoles are operated by connecting either for only 2 sec. in http just to transmit commands, or for however long human curiosities might last in hands-on intrusion.
(6) The 2012 April
http://www.waraxe.us/content-84.html views product.php on Windows, but that is scarcely the only index.php?route approach for the sake of 64 bit decryption in mime attacks, let alone on Linux. Attacking product.php appears to have been exceedingly rare even on Windows. Attacking by way of double- and multiple file extensions so as to turn fake text .jpg files into executable .php files that actually attack from within has come to light fairly recently, and while not common is no longer rare world wide even on Linux.
(7) You might care to read the currently 4+ pages of
http://forum.opencart.com/viewtopic.php?f=20&t=98644
[I may add further links here this evening or in the morning, rather than separating them in another post.]
(8) If your server offers ModSecurity firewalling you may want to utilize it, it works very well in stopping suspicious code.
