via blog.sucuri.net => original post link
One of our clients recently submitted a malware removal request with a curious problem: A mystery admin user kept getting re-created on their website. Try as they might, nothing they did would get rid of this user; it just kept coming back.
A suspicious “user” that just won’t go away…
It was suspiciously generic, named simply “user” and had no name, content, or email attached to it.