Thanks for the note, I knew there would be others out there that had been hit by them too.

I found the spammer (http://www.searchup.de/promo-ten/maschinen.html) by just checking my referrers in my thecounter.com account (java counter I have on all my pages).

note: I check often to find things just like this. Over the last month I have found 3 sites that took a flash file of mine off Flashkit.com and passed it off as their own work on their site. All someone has to do is click once from their site and thecounter puts it in my "last 30 referrers". This last week I have been waiting to find one from germany (.de) and yesterday I got him.

And to answer your other question,

In add.cgi, under the sub process_form,

replace:
# Check the referer.
if (@db_referers and $ENV{'HTTP_REFERER'}) {

with:
# Check the referrer.
if (@db_referers) {


- I found this tip somewhere in the forums last night. So far today, Saturday, I have not received any from germany, time will tell if it did the trick. I am also looking into a staggered add format, off of inspiration from Anthro. My wife speaks German, so she is going to help me figure their site out and if there are any additional steps I can take, maybe some just to piss them off too, no, that would be childish. ;>}

PS, I am posting this in the thread too, might be helpful for others too?

Tim
support@ezFriend.com