[joethaman]

I did some more searching over the last couple days and there were some issues, exploits, vulnerabilities or whatever, where files (other than images) can be uploaded using vbpicgallery, photpost classifieds, and photopost vbgallery, and vbadvanced cmps. All of them seem to have been resolved except for vbadvanced cmps, or at least not that I could find. It's kind of my fault that I haven't been keeping up with the updates, but I haven't been receiving any notifications that any new updates have been released.

What I've been doing over the last few days is using woopra to track all of the visitors whose languages are arabic, and banning those IP's. So far, using those IP's and searching the logs, they've been attempting to access the directories where the old sniper_sa scripts were and have also helped me locate where other scripts have been placed within my site. After a few days of watching, I've done an IP ban on the internet provider that this guy has been using, which is also a very common ip used by hackers and spammers.. 213.0.0.0/8. This pretty much blocks all IP's from 213.0.0.0 to 213.255.255.255. if you do a reverse IP lookup on the spammer/hacker you can sometimes view the ISP's info and it will tell you the IP's that they cover, in this case, start IP was 213.0.0.0 to 213.255.255.255.

If you're not familiar with how to block IP's, here is how you do it. If you search for .htaccess and deny IP you can find some documentation on it.

<Files 403.shtml>
order allow,deny
allow from all
</Files>

deny from 212.14.224.2
deny from 84.41.118.98
deny from 213.0.0.0/8
deny from 193.0.19.25