"Warning: Cannot modify header information" upon login

[crwoodhouse]

I get the following message upon login to the site:

“Warning: Cannot modify header information – headers already sent by (output started at /home/spucl/public_html/youcangosocial/index.php:9) in /home/spucl/public_html/youcangosocial/wp-content/plugins/wp-eMember/emember_auth.php on line 261

Warning: Cannot modify header information – headers already sent by (output started at /home/spucl/public_html/youcangosocial/index.php:9) in /home/spucl/public_html/youcangosocial/wp-content/plugins/wp-eMember/emember_auth.php on line 263″

It also redirects to the wrong page (I have set the page specifically to the homepage, but users are sent to http://youcangosocial.com/member-login/)

I have already attempted deactivating and deleting the original install, uploading and activating a fresh installation – no luck.

This is a very basic configuration, with no WordPress account integration, one level of paid membership, and thus far only one member – me. I’m not sure why it isn’t working.

Any ideas?

[Peter]

Hi,

When I tried going to your site by clicking the link you provided my virus checker tells me you have a trojan on your website. Looks like your site has been hacked perhaps?

[crwoodhouse]

It was just setup in the last couple of hours, so that is fairly impossible. I’m currently talking with hosting support since I just discovered this issue is also on another WordPress site hosted with them.

[crwoodhouse]

Are you still receiving trojan warnings from the site? If so, could you tell me if your scanner tells you exactly which file the trojan is coming from? I did a virus scan on all sites and found nothing, and the issue is still present.

[Peter]

Yes I still get the warnings.

My virus checker says you are infected with Iframe-OC [Trj].

I am also seeing a strange “)” character in your URL :

youcangosocial.com/member-login/)

Unfortunately my virus checker isn’t telling me which file the trojan is in.

Found a few entries in the wordpress forum talking about it too:

http://wordpress.org/support/topic/virus-warning-jsiframe-actrj-on-my-site

[crwoodhouse]

UGH okay, this is an issue other users may face so I should state this here.

Over the past week, my host changed a default attribute of all PHP installations on their server.

They changed “output_buffering” from “On” or “4096” to “Off”.

If you do not have a custom php.ini file installed in your wordpress directory, and your host turns off output buffering, you WILL get this error if there are any extra spaces in the scripts running your site.

To resolve this issue, simply create a file called php.ini in notepad and put the following code in it:

[PHP]

output_buffering=4096

Save it, then upload it to your wordpress directory (or sub-directory, if you are seeing this issue in /wp-admin for example.)

Voila, problem solved.

My host changing the default setting of that variable on the server is what caused it to happen across multiple sites. The error was unrelated to the one cache file that the virus scan removed, and unrelated to the script.

Hope that helps somebody some day!

[Peter]

Thanks for the info.

[Author]

Posts