is this an exploit or what?

[Luis Manson]

Just found this on cache/

cat 7a8a823f8b7c.pHp 

==============================================================================
=========================        END       ===================================
========================= /interface/blog/xmlrpc.php?sid=14eb97dd10564a7e7e42c90ca9aa66de& ===================================
==============================================================================

[Aiwa]

doesn't look legit to me...

[Luis Manson]

me neither, i tried to decode it, but i was not able to do it :S

[AtariAge]

I just found a very similar file in my cache directory.

..Al

[bfarber]

That looks like a leftover file from a previous exploit and should be removed. It is certainly not a file IP.Board utilizes.

[AtariAge]

That looks like a leftover file from a previous exploit and should be removed. It is certainly not a file IP.Board utilizes.

Oh, I removed it alright. With prejudice!

[Dmacleo]

wold think anything using pHp (capitol H) would never be legit.

[Luis Manson]

yesturday i had chmod 000 the file in the meanwhile

[Rhett]

Here is an article you can use to help clean up your site if needed http://community.invisionpower.com/resources/guides.html/_/knowledge-base/how-to-clean-your-site-from-infection-r266