I noticed a couple dozen 'qaz001' Administrator accounts yesterday on my forum too. I deleted the accounts, and deleted the install directory. On my site, no nefarious plugins had been installed. I think what saved us was .htaccess password protection on the admincp directory. The real danger was almost dying of a heart attack when I saw all those unknown admin accounts!
If you google for inurl:/forum qaz001 administrator you can see that a lot of these accounts have been added to many forums recently.
|