Exploit Toolkit Website 33 Attack

Originally Posted by Lucille

I don't know if it is related to anything else, but the last several times I've tried to access this site I got the following message:

Fatal error: Call-time pass-by-reference has been removed in /home/fauna/public_html/chat/api.php on line 6

Yeah, this wasn't one of my better days.

Along with this stuff, I've been fighting with a problem concerning PayPal transaction (IPNs) being passed to this site when members would upgrade to paid memberships. The PayPal transaction would go through, I would get an email notice about it, but the notice sent to this site to perform the actual upgrade was either never sent, or this site's code never got it. Anyway, my programmer thought that something in PHP got screwed up so I asked the server guys to recompile PHP for me.

BOOM!

Not sure if they left off a module during the recompile or it was the fact that they went to version 5.4, that I have heard vBulletin has some issues with. Anyway, they backed on down to v5.3 and recompiled, and so far the site is up. Haven't checked on that original IPN problem yet, but this all gave me a splitting headache and I'm just going to walk away from it for a while.

Computers.............aaarghhh!!!!!!

Not sure if it's part of this, but user profiles aren't coming up right.

I had that as well! Thought it might have been just me... Thank goodness I'm not going bonkers. lol

Originally Posted by WebSlave

Not sure if they left off a module during the recompile or it was the fact that they went to version 5.4,

I thought it was going to be 5.4 issue. I had issue with 5.4 and some add on's with vbulletin for a computer site I was helping on.

Something strange is really going on, I just got this email from webmaster@faunaclassifieds.com - here's the source coding attached as a txt file

I'm also seeing a problem with the profile pages.

Originally Posted by TheFragginDragon

Something strange is really going on, I just got this email from webmaster@faunaclassifieds.com - here's the source coding attached as a txt file

I'm also seeing a problem with the profile pages.

Beats the hell out of me.... Anyone want to buy a website?

I'm TIRED of this crap...........

Originally Posted by RoyalPythonPros

Not sure if it's part of this, but user profiles aren't coming up right.

I ran the repair utility on all of the tables in the database. Please see if that straightened up this profile problem.

Negative, my profiles still shows only partially.

Originally Posted by TheFragginDragon

Negative, my profiles still shows only partially.

Ouch, yeah I see that. Not sure what is going to happen from here, but expect the server to go offline without warning at any time.

Just to add my experience...

I also got the Website 33 warning today.
For the past few days I've also had fauna fail to load and the URL bar showing a different address.

I don't know if it's coincidental or not but I just started running Symantec Endpoint Protection two weeks ago. In the Website 33 instance it just blocks it and allows the site to load. In the other instance it fails to load the site and I get a notification from Symantec that a certain IP has been blocked for 600 seconds.
An immediate reload of the site works though.

I've had no problems with my laptop, which is running Linux, it has only happened with the desktop whixh is running XP and Symantec Endpoint.

As for the ad blocking software, I'm not sure how exactly that software works. Whether it blocks the ads at the source or it allows the code to be loaded and only blocks the visibility. If the latter is the case then a google ad could still be the problem.

I've been having these instances happen for the last 4 ro 5 days I think.