Spammer/Hacker Problems
 

I'm running vBulletin 3.8.1 as a support forum on a new site and on a dedicated server. The forum, although open, has not yet become active.

A number of weeks ago, we received a call in the late hours that our server had been hacked and that it now had a PayPal phishing site on it. A number of steps were taken to remove it, change all our passwords and add some additional security to the server's setup. We found out a couple of days later that a fired employee of a programmer we had used had either setup the phishing site or had sold our password to some hackers.

There is no evidence of anyone gaining access to our server since making these changes.

What we are experiencing, however, are constant and regular registrations from an individual or group of individuals who would appear to be spammers. Our forum is setup to moderate registrations which requires the registrant to fill in half a dozen fields to be able to submit it. Our response to these totally obvious registrations has been to delete or reject them without notification and to add the IP to the list in Banning Options. This has only served to increase the number of bad registrations we are receiving. We had expected that at some point they would move on to greener pastures. We've even tried closing the forum for a few days and as quickly as I reopen the forum, the bad registrations start coming in again.

My first question, considering the hacking that occurred, is whether or not the act of registering could put these miscreants in a position to cause some other harm or to gain any access to our server? The persistence of their efforts causes me to suspect it is more than just an effort to make a post extolling the virtues of Viagra. Are there any known files that may have been left behind during the hack that may be providing some access or exploit that I should be searching for?

My second question is what other measures should I consider to dissuade them from registering again? Tachy Goes to Coventry comes to mind but then I would have elevated them to an accepted registration status which doesn't seem a good idea to me.

Thanks for any feedback or help you may have to offer.