I am dealing with exactly this -
SO 2 weeks ago - I came to my site and found this
Imagine my horror lol!
I tried to lock everything down , removed the bad code and all was quiet. Then 2 weeks later - I get a malicious code warning from my google chrome. I check my admins and Voila! There are like 10 new admins added to my site! So again I locked everything down. Then this morning I wake up to see 10 new registrations - and guess what - they are exactly like what's posted above. So I realize that I never really deleted my install folder.. in fact i just removed the install file to deactivate it. So I'm off to follow the instructions on the links and to try again. I think I"ll be doing a fresh install of VB anyway and deleting all of my plugins till I get to the bottom of this.
Also - I looked in that ech plugin ( and I have 6 of them...) - and this is what I see :