spamer help needed

[mastertek2000]

every time i try to make a post in my site only i get this

https://vborg.vbsupport.ru/attachment.php?attachmentid=123530&d=1289387652

[Outbackmark]

This is more than just a spammer, for that to happen something has been done to one or more of your php files.
I would suggest you upoad new newreply.php and newthread.php as I can't think how this could happen without those files having been changed. I stand to be corrected, but it would not hurt to do this, before you upload the new files, change the name of the old ones, just put a .old on the end so you can edit and reuse them if needed.
You should also change passwords to the CPanel and other FTP accounts, also run the VB Diagnostics/Suspect File Versions to ensure there are no other files that should not be there.

[mastertek2000]

that did not work any other ideas thanks for your help

[Outbackmark]

OK the only other way it could be happening is by using the hook system, if you disable the hooks in the config.php file (in the includes directory), or via the Options Menu/Plugin Hook System and see if that helps.

[mastertek2000]

i cant find that where is it

[Outbackmark]

In the Admin CP, go to "VB Options", scroll down to "Plugin/Hook System" and turn it off.

[mastertek2000]

That did not work either

[Outbackmark]

OK it's got me then, no more immediate ideas, hopefully Lynne or Paul will be along soon, wish I could help more!

[mastertek2000]

Thanks for taking your time to try to help me

[kh99]

I'm not an expert on site hacking (if that's what's going on), but there could be something in a template like an image or link to some file on that site. I think I'd use something to see what the request is for, like FireFox with the TamperData add-on (or maybe someone else knows of an alternative). Then if you can figure out what's being requested from that site, you can search around to figure out where it's coming from. (It looks like your forum is closed or else I would have tried it myself).

[mastertek2000]

forum is open now but now seam to be working fine thank you for your advice

[kh99]

I think it's still requesting something from that site but apparently they removed the password. It looks like it has something to do with the "Wrap [PDF] tags around selected text" thing that you have in your message editor. (of course if that's something you know about then it's probably OK).

[mastertek2000]

I think it's still requesting something from that site but apparently they removed the password. It looks like it has something to do with the "Wrap [PDF] tags around selected text" thing that you have in your message editor. (of course if that's something you know about then it's probably OK).

thanks for taking the time to help me i did remove the pdf tags checked everything seams normal now not sure will post if i find something