Modey Module issues again

So the whole thing randomly quit working im getting this message

my server fine everyhting is working normally except the money


11:51:00 - [jOpenSimMONEY]: Unable to connect to Money Server world.youthnation.live/index.php?option=...ensim&view=interface . Exception System.Xml.XmlException: There are multiple root elements. Line 2, position 2.
at System.Xml.XmlTextReaderImpl.Throw (System.Exception e) [0x00027] in <51340a64616e4fed93c3acf2705ed3f4>:0
at System.Xml.XmlTextReaderImpl.Throw (System.String res, System.String arg) [0x00029] in <51340a64616e4fed93c3acf2705ed3f4>:0
at System.Xml.XmlTextReaderImpl.Throw (System.Int32 pos, System.String res) [0x0000c] in <51340a64616e4fed93c3acf2705ed3f4>:0
at System.Xml.XmlTextReaderImpl.ParseDocumentContent () [0x001e5] in <51340a64616e4fed93c3acf2705ed3f4>:0
at System.Xml.XmlTextReaderImpl.Read () [0x0008c] in <51340a64616e4fed93c3acf2705ed3f4>:0
at System.Xml.XmlTextReader.Read () [0x00000] in <51340a64616e4fed93c3acf2705ed3f4>:0
at Nwc.XmlRpc.XmlRpcResponseDeserializer.Deserialize (System.IO.TextReader xmlData) [0x00091] in <8b18a3f77e3d43749783ea6d6a33b1c1>:0
at Nwc.XmlRpc.XmlRpcRequest.Send (System.String url, System.Int32 timeout, System.Net.Security.RemoteCertificateValidationCallback certCallBack) [0x000ab] in <8b18a3f77e3d43749783ea6d6a33b1c1>:0
at OpenSim.Modules.Currency.jOpenSimMoneyModule.genericCurrencyXMLRPCRequest (System.Collections.Hashtable reqParams, System.String method) [0x0006c] in <21cc3161c7b34e30956339ab681b7b7e>:0
11:51:00 - [jOpenSimMONEY]: getSettingDataInt - Error for groupCharge:
11:51:00 - [jOpenSimMONEY]: Unable to connect to Money Server world.youthnation.live/index.php?option=...ensim&view=interface . Exception System.Xml.XmlException: There are multiple root elements. Line 2, position 2.
at System.Xml.XmlTextReaderImpl.Throw (System.Exception e) [0x00027] in <51340a64616e4fed93c3acf2705ed3f4>:0
at System.Xml.XmlTextReaderImpl.Throw (System.String res, System.String arg) [0x00029] in <51340a64616e4fed93c3acf2705ed3f4>:0
at System.Xml.XmlTextReaderImpl.Throw (System.Int32 pos, System.String res) [0x0000c] in <51340a64616e4fed93c3acf2705ed3f4>:0
at System.Xml.XmlTextReaderImpl.ParseDocumentContent () [0x001e5] in <51340a64616e4fed93c3acf2705ed3f4>:0
at System.Xml.XmlTextReaderImpl.Read () [0x0008c] in <51340a64616e4fed93c3acf2705ed3f4>:0
at System.Xml.XmlTextReader.Read () [0x00000] in <51340a64616e4fed93c3acf2705ed3f4>:0
at Nwc.XmlRpc.XmlRpcResponseDeserializer.Deserialize (System.IO.TextReader xmlData) [0x00091] in <8b18a3f77e3d43749783ea6d6a33b1c1>:0
at Nwc.XmlRpc.XmlRpcRequest.Send (System.String url, System.Int32 timeout, System.Net.Security.RemoteCertificateValidationCallback certCallBack) [0x000ab] in <8b18a3f77e3d43749783ea6d6a33b1c1>:0
at OpenSim.Modules.Currency.jOpenSimMoneyModule.genericCurrencyXMLRPCRequest (System.Collections.Hashtable reqParams, System.String method) [0x0006c] in <21cc3161c7b34e30956339ab681b7b7e>:0

For who finds this on Google:

The issue in this case was running an infected WordPress site on same vHost.

The messageindicates some output from the xmlrpc response before the tag <?xml ...> is sent. Most of time it is some php warning or similar.

But in this case it was an issue related to blog.sucuri.net/2022/12/fake-jquery-doma...e-visitors-scam.html

Greetz
FoTo50