Using J3.4 and CB 1.9.1. Front end registration is off. Created a new user in back end, saved. When I return to User Management, the name appears as entered. However, when I go the individual profile, the name has been changed to a series of random letters. First and last are the same, much like a CB spam registration would appear. But it does not seem to be saved in the profile. The user management page still shows the correct name, unless I go into the profile and save when I exit.
Failed solutions:
1. FTP'd entire site and did a local virus scan on it, nothing.
2. WeMaHu Joomla virus scanner (not sure if it really works, but worth a try), nothing.
3. Looked through comprofiler folders for files with different dates, nothing stuck out as obvious.
In the Joomla core user management profile, the names are NOT changed. Only in the CB profile. Not really sure where else to look or if there is a better tool or technique to find these things.
It's probably a well-known hack, don't think it's anything new.
Anyone know where the bad guys typically hide these things?
nant