Geeklog Forums

A new spammer seems to be on the loose from the domain mistacronks.com It seems that there is a robot creating new users. I just wanted the community to be on guard.

---

Geeklog is the best. ------ Yes, I know. I should change my name to conehead. :-)

I've just spent the last week circumventing all the comment spam generated from the bot that tunneled into mistacronks(dot)com and can safely say I've gotten the upper hand ... finally.

Everyone: check your server for c99.php (shell script) and its 2 accessory files (bind and dll). Then check your database for extemporaneous tables and/or entries. Also, ban header requests containing VIA: PROXYWTC.

It's been kinda fun, actually. I haven't had a good challenge like this for a couple of years.

--
Technohippie

Can't find c99.php, so I took a different approach:

http://www.geeklog.net/forum/viewtopic.php?showtopic=69489

I'm not a PHP expert, but it's been 100% effective so far.

Jon