Just found this on cache/

cat 7a8a823f8b7c.pHp 

==============================================================================
=========================        END       ===================================
========================= /interface/blog/xmlrpc.php?sid=14eb97dd10564a7e7e42c90ca9aa66de& ===================================
==============================================================================

doesn't look legit to me...

me neither, i tried to decode it, but i was not able to do it :S

I just found a very similar file in my cache directory.

..Al

That looks like a leftover file from a previous exploit and should be removed. It is certainly not a file IP.Board utilizes.

That looks like a leftover file from a previous exploit and should be removed. It is certainly not a file IP.Board utilizes.

Oh, I removed it alright. With prejudice!

wold think anything using pHp (capitol H) would never be legit.

yesturday i had chmod 000 the file in the meanwhile

Here is an article you can use to help clean up your site if needed http://community.invisionpower.com/resources/guides.html/_/knowledge-base/how-to-clean-your-site-from-infection-r266