Me

I appreciate the contact. I did just give up and revert back to Super Cache. However as stated I have WordPress in a subdirectory and URL was set for that directory and the site URL as the root domain.

W3 Total Cache failed to load as it seemed to not find the necessary files. I also noticed W3 Total Cache isn’t fully PHP 5.3 compatible, at least not as a few weeks ago.

Below is a list of errors – you’ll notice error messages repeated and that is due to each separate occurrence being noted.

w3-total-cache/inc/define.php
[PHP 5.3] Assigning the return value of new by reference is deprecated in PHP 5.3

w3-total-cache/inc/lightbox/self_test.php
[PHP 5.3] INI directive ‘safe_mode’ is deprecated.

w3-total-cache/lib/Nusoap/class.soap_transport_http.php
[PHP 5.3] INI directive ‘safe_mode’ is deprecated
[PHP 5.3] INI directive ‘safe_mode’ is deprecated

w3-total-cache/lib/Nusoap/nusoap.php
[PHP 5.3] INI directive ‘safe_mode’ is deprecated
[PHP 5.3] INI directive ‘safe_mode’ is deprecated

w3-total-cache/lib/W3/Cache.php
[PHP 5.3] Assigning the return value of new by reference is deprecated in PHP 5.3
[PHP 5.3] Assigning the return value of new by reference is deprecated in PHP 5.3
[PHP 5.3] Assigning the return value of new by reference is deprecated in PHP 5.3
[PHP 5.3] Assigning the return value of new by reference is deprecated in PHP 5.3
[PHP 5.3] Assigning the return value of new by reference is deprecated in PHP 5.3
[PHP 5.3] Assigning the return value of new by reference is deprecated in PHP 5.3
[PHP 5.3] Assigning the return value of new by reference is deprecated in PHP 5.3
[PHP 5.3] Assigning the return value of new by reference is deprecated in PHP 5.3

w3-total-cache/lib/W3/Cache/Memcached.php
[PHP 5.3] Assigning the return value of new by reference is deprecated in PHP 5.3

w3-total-cache/lib/W3/Cdn.php
[PHP 5.3] Assigning the return value of new by reference is deprecated in PHP 5.3
[PHP 5.3] Assigning the return value of new by reference is deprecated in PHP 5.3
[PHP 5.3] Assigning the return value of new by reference is deprecated in PHP 5.3
[PHP 5.3] Assigning the return value of new by reference is deprecated in PHP 5.3
[PHP 5.3] Assigning the return value of new by reference is deprecated in PHP 5.3
[PHP 5.3] Assigning the return value of new by reference is deprecated in PHP 5.3
[PHP 5.3] Assigning the return value of new by reference is deprecated in PHP 5.3
[PHP 5.3] Assigning the return value of new by reference is deprecated in PHP 5.3
[PHP 5.3] Assigning the return value of new by reference is deprecated in PHP 5.3
[PHP 5.3] Assigning the return value of new by reference is deprecated in PHP 5.3
[PHP 5.3] Assigning the return value of new by reference is deprecated in PHP 5.3

w3-total-cache/lib/W3/Cdn/Mirror/Netdna.php
[PHP 5.3] Extension ‘mhash’ is not available in PHP 5.3 – use the ‘hash’ extension instead

w3-total-cache/lib/W3/Cdn/Rscf.php
[PHP 5.3] Assigning the return value of new by reference is deprecated in PHP 5.3

w3-total-cache/lib/W3/Cdn/S3.php
[PHP 5.3] Assigning the return value of new by reference is deprecated in PHP 5.3

w3-total-cache/lib/W3/Cdn/S3/Cf.php
[PHP 5.3] Assigning the return value of new by reference is deprecated in PHP 5.3

w3-total-cache/lib/W3/Db.php
[PHP 5.3] Assigning the return value of new by reference is deprecated in PHP 5.3

w3-total-cache/lib/W3/Minify.php
[PHP 5.3] Assigning the return value of new by reference is deprecated in PHP 5.3
[PHP 5.3] Assigning the return value of new by reference is deprecated in PHP 5.3
[PHP 5.3] Assigning the return value of new by reference is deprecated in PHP 5.3
[PHP 5.3] Assigning the return value of new by reference is deprecated in PHP 5.3
[PHP 5.3] Assigning the return value of new by reference is deprecated in PHP 5.3
[PHP 5.3] Assigning the return value of new by reference is deprecated in PHP 5.3
[PHP 5.3] Assigning the return value of new by reference is deprecated in PHP 5.3

w3-total-cache/lib/W3/PgCacheFlush.php
[PHP 5.3] Assigning the return value of new by reference is deprecated in PHP 5.3

w3-total-cache/lib/W3/Plugin/CdnAdmin.php
[PHP 5.3] Assigning the return value of new by reference is deprecated in PHP 5.3

w3-total-cache/lib/W3/Plugin/DbCache.php
[PHP 5.3] Assigning the return value of new by reference is deprecated in PHP 5.3

w3-total-cache/lib/W3/Plugin/Minify.php
[PHP 5.3] Assigning the return value of new by reference is deprecated in PHP 5.3

w3-total-cache/lib/W3/Plugin/MinifyAdmin.php
[PHP 5.3] Assigning the return value of new by reference is deprecated in PHP 5.3

w3-total-cache/lib/W3/Plugin/ObjectCache.php
[PHP 5.3] Assigning the return value of new by reference is deprecated in PHP 5.3

w3-total-cache/lib/W3/Plugin/PgCacheAdmin.php
[PHP 5.3] Assigning the return value of new by reference is deprecated in PHP 5.3
[PHP 5.3] Assigning the return value of new by reference is deprecated in PHP 5.3

w3-total-cache/lib/W3/Plugin/TotalCache.php
[PHP 5.3] Assigning the return value of new by reference is deprecated in PHP 5.3
[PHP 5.3] Assigning the return value of new by reference is deprecated in PHP 5.3

w3-total-cache/lib/W3/Plugin/TotalCacheAdmin.php
[PHP 5.3] Assigning the return value of new by reference is deprecated in PHP 5.3
[PHP 5.3] Assigning the return value of new by reference is deprecated in PHP 5.3
[PHP 5.3] Assigning the return value of new by reference is deprecated in PHP 5.3
[PHP 5.3] Assigning the return value of new by reference is deprecated in PHP 5.3
[PHP 5.3] Assigning the return value of new by reference is deprecated in PHP 5.3
[PHP 5.3] Assigning the return value of new by reference is deprecated in PHP 5.3
[PHP 5.3] Assigning the return value of new by reference is deprecated in PHP 5.3
[PHP 5.3] Assigning the return value of new by reference is deprecated in PHP 5.3

Thanks for the quick response as many developers don’t respond. I would like to address two items:

1) If PHP 5.3 is configured with all errors even the warnings will through a fatal error.

2) In PHP 5.4 ALL safe mode calls will throw a fatal error and crash the script. PHP is telling all programmers NOT to use safe mode calls at all.

https://www.php.net/manual/en/features.safe-mode.php

Respectfully,

Jeremy

I should also add in addition to the port one should able to specify a specific IP(s) for Memcached. There are installs out there that run Memcached on a separate server or even servers.

You must have a twitter plugin and your site is trying to find it. It is possible a plugin got disabled in your theme. I would check to see if you have any disabled plugins.

It depends on how deep this goes but for starters I would download the WordPress 2.8.4 install file from www.ads-software.com and FTP the wp-settings.php to your site and see if that fixes it.

Yeah. If your install is tight and the latest build I wouldn’t worry about it. It may just be your turn. Our sites have patterns too. Spam always but at times it gets worse and slows down for a bit then picks back up. The eb and flow of the spammers.

Well it is possible you got a hack in there somewhere that is allowing people to post to your blog. Do you see any usual admin accounts? Take note of how many admins are being counted in the tab and displayed. At times you will see Administrators (2) but only one account because one is hidden.

Your site is being hacked with a known issue. You really need to upgrade to 2.8.4 to be protected, however the damage needs cleaning up too.

https://www.ads-software.com/support/topic/307518?replies=162

There is only real var which is the absolute variable for directories. However move the entire wp-admin, wp-content, wp-includes, etc to a non web accessible folder and no go.

There should be just a few files on the web accessible side that load the core system in a non web accessible path.

So for wp-admin.php only index.php should be there. Which simply calls wp-config.php and loads the custom absolute path which contains the wp-content, wp-includes, wp-admin, etc.

Of course so many mods are programmed not to follow that logic which is to bad.

@josephscott

I sent you my logs so you can see if you can infect a copy of your own.

@rwboyer

Well I agree a multiprone approach is a good idea. However if you go back three days in backups you might have function_gpc somewhere in them too. Afterall who knows many advances this hack has gone through.

Bottom line is do several things. That is what I am doing.

@rwboyer

Well I agree check mod dates isn’t a bad idea. However a common item here is the default exploit tries to hack files and add a function gpc_ into the files.

The command above will run a quick check to make sure it isn’t any files in the path. I do agree that after a hack no can’t be 100% what else might have been done but as with many hacks there is a basic fingerprint and that function gpc_ is one of them.

@kirkpete

If you have shell access see my thread above as it will allow your system, if *nix based, to search your files to see if they have been compromised with that extra code.

Now I can’t promise other stuff isn’t there but if you don’t have any matches for function gpc_ you are probably okay.

This is why when I design applications I put the code base in a non web accessible folder and the files in the web folder only call the code base. That way fools can’t just run files like the permalink file that is only there to be called by other scripts.

Example:

/public_html/index.php

index.php contains one line:

include_once(“/websafe/load.core.inc.php”);

from that point everything else can be loaded which often includes dozens if not hundreds of files. Of course I often have an admin.php and user base but still no real code sits inside the web folder. I wish WP would have a path command so we could move the files into this kind of setup if we wanted.

As mentioned once xmlrpc.php has been used to hack in then all beats off. The first point of entry is xmlrpc.php

BTW: For those that have shell access you may run the following command to see if any files have had the function gpc_ added. Note the quotes you can change this to whatever you want. Simply log in and in your website home directory in shell run the following

shell> grep -r -i “function gpc_” ./

This command will print ANY files that have been infected. Note this will NOT work on Windows and hasn’t been verified on all *nixes. It was used on Redhat Enterprise.