Admin account compromised

[TheLastSuperman]

Originally Posted by sattvhelp

Thank you for the information. The link shows the file, i found that link after googling part of the file to try and understand what it was. The file was hosted for around 20 minutes before it was located and removed

That file does what Dave mentioned above i.e.

Originally Posted by Dave

The script you linked is called a "PHP Shell" or "PHP Backdoor", it allows people to interact with the server/database/any files on the server in any way they want.

Now the question whether there are any backdoors left is hard for us to answer. All it takes is one line of code to act as a backdoor, this can be hidden in any of the thousand(s) of files vBulletin uses.

So be sure to check for files with modified timestamps or new files on the server, Dave is correct about it taking one line of code or also one file to still allow backdoor access into your site if not the entire server so be sure to double, triple check okay?