Think I got it. I saw it trying to load in the status bar of the browser, found a suspect file version of a file, and replaced it. I no longer see it trying to load.
Where we stand now is I am hyper-vigilant of new user registrations, and try to delete bogus ones that get through before they can do anything. Sometimes I can not be quick enough.
A permanent solution is not so easy because of our situation here. Possible solutions are:
Get rid of the Casino. It is a known vulnerability, but a lot of people here like it. Also, I do not know for sure if this is the way they are getting in.
Completely closing new user registration.
The real solution here (which probably also means losing the Casino), is updating the board software. As most of you know, I do not own .com or the board itself. I need to rely on Austin at Chiefsplanet for any changes at the software level. He has been unresponsive to me the last few times I have tried to contact him. So there is nothing I can do here.
The last solution would be to abandon patriotsplanet.com and start anew at patriotsplanet.net or a new domain. I would have the control and the ownership necessary to make any software upgrades needed. We would lose our history here and probably more users in the transition.
That is most of what I can think of, and they all suck in their own way.