Spam Help!! I'm really stuck, guest posting spam

[hogan00]

Hi

I'm having a really big problem.

Every time I post a new thread a guest post gets created automatically just above the thread!!

See here:

http://themoneyguide.ca/forum/showthread.php/67-asdasdadsa?p=6364#post6364

How can a guest post, and why is this happening automatically every time I created a new post.

Any help would be greatly appreciated.

Thanks

[socialteenz]

You need to install a anti-spam mod to strengthen your registration process.

My suggestion would be this as lot of people are getting good results after installing this mod.

https://vborg.vbsupport.ru/showthread.php?t=289463

[borbole]

Disable the posting permissions for guests if you don''t want them to post.

[hogan00]

posting is disabled for guests, that's why I'm so confused.

Also, the guest post is automatic once I post anything new???

Anyone have this problem before?

[Simon Lloyd]

You have had your core files compromised, you've had a virus or such like, check your php files for BASE64 code, start with newthread.php, if you have been compromised you need to think why? insecure scripts or ones that haven't been updated are usually the culprit.

To rectify the issue of corrupt files simply upload a whole new batch of core files (with overwrite) via ftp, you can leave out the images folder and delete /install/install.php before uploading.

[borbole]

posting is disabled for guests, that's why I'm so confused.

Also, the guest post is automatic once I post anything new???

Anyone have this problem before?

This is weird. Guests shouldn''t be able to post if they don''t have permissions for that. Can you post here a screenshot of the guest group permission settings?

What mods do you have installed btw?

[betterthanyours]

This is obviously a case of where your webserver / files has been compromised.

I'd suggest the same as Simon_Lloyd. Upload fresh files. If still an issue, I'd suggest you have a look at your SQL DB structure or hire an SQL developer.

[hogan00]

You have had your core files compromised, you've had a virus or such like, check your php files for BASE64 code, start with newthread.php, if you have been compromised you need to think why? insecure scripts or ones that haven't been updated are usually the culprit.

To rectify the issue of corrupt files simply upload a whole new batch of core files (with overwrite) via ftp, you can leave out the images folder and delete /install/install.php before uploading.

Simon

Thank you very much for the response. By "core" files do you mean all the vbulletin files?

[Max Taxable]

There is a 6 hour and 7 minute difference in the timestamps of the posts. You're saying the spam guest post appears simultaneously after YOU make a post? The spam guest post appears to be the OP of the thread. So I'm kind of confused about what you're saying is happening.

If I didn't know better, I would say this looks like you're posting this here, merely to spam vB dot org by proxy.

[hogan00]

There is a 6 hour and 7 minute difference in the timestamps of the posts. You're saying the spam guest post appears simultaneously after YOU make a post? The spam guest post appears to be the OP of the thread. So I'm kind of confused about what you're saying is happening.

If I didn't know better, I would say this looks like you're posting this here, merely to spam vB dot org by proxy.

What are you talking about??

Why would I do that? I have a legitimate problem here.

Let me try to post another example...

Just posted this...

http://themoneyguide.ca/forum/showthread.php/1246-test-2012?p=7543#post7543

yes, the time stamps are different, not sure why.

--------------- Added 1355982003 at 1355982003 ---------------

You have had your core files compromised, you've had a virus or such like, check your php files for BASE64 code, start with newthread.php, if you have been compromised you need to think why? insecure scripts or ones that haven't been updated are usually the culprit.

To rectify the issue of corrupt files simply upload a whole new batch of core files (with overwrite) via ftp, you can leave out the images folder and delete /install/install.php before uploading.

replaced the core files, but now I can't access the site:

http://themoneyguide.ca/forum

????

[Max Taxable]

What are you talking about??

Why would I do that? I have a legitimate problem here.

Let me try to post another example...

Just posted this...

http://themoneyguide.ca/forum/showthread.php/1246-test-2012?p=7543#post7543

yes, the time stamps are different, not sure why.You start a thread, and your OP is replaced with the spam OP? You're starting the threads with the spammy titles, or is your title of the thread being replaced?

I was joking about you being the spammer, I should have used a smilie.

[Simon Lloyd]

What are you talking about??

Why would I do that? I have a legitimate problem here.

Let me try to post another example...

Just posted this...

http://themoneyguide.ca/forum/showthread.php/1246-test-2012?p=7543#post7543

yes, the time stamps are different, not sure why.

--------------- Added 1355982003 at 1355982003 ---------------



replaced the core files, but now I can't access the site:

http://themoneyguide.ca/forum

????Did you replace them by ftp or did you delete them and re-upload?, it should have been by ftp with overwrite, anyway, you'll need to go to /includes/config.php.NEW and edit to to include your email address, database name....etc, all the stuff you did originally, save it then rename it to config.php (only do the above if your config.php is missing).