The process is never ending. I change the sign-up process a few times per year to keep the validation question different. I block the IP addresses of spammers when we see them, sometimes even blocking subnet ranges when I see a lot of bot traffic coming from the same region.

What you and others are doing now is perfect: just file a report when new spam posts are made. I get sent a note which allows me to deal with them more quickly: specifically, destroy the account and block the IP address.

I, too, report as many as I spot. A lot of times they've already been reported. Lately some are getting very close to looking like legitimate posts. Sometimes its hard to tell so implying folks are naive even if they do respond is a tad bothersome (at least to me) they may have been tired, or just not thinking. They (the spammers) seem to come in waves. BW is doing the best he can, or so I think..buttering up the head honcho here.

Spiderweb has been getting a few spambots that seem to be posting a human written generic post that's usable for many board sites. The clue is they also post with links to commercial sites.

Not really. Most of them give it away with the link(s) in their signature or profile. The ones that don't make it that obvious usually post in an old topic and contribute nothing. The name of the poster can be a good indicator too.

And Dragonlady, I delight in the irony of your post.

I know it's probably not applicable here, since BW uses phpBB, but maybe there are phpBB equivalents that will help.

I use vBulletin, along with 2 free plugins: NoSpam! Image Enhancement and Glowhost's Spam-o-matic.

The first one presents an image to a potential new user during the registration process, but it isn't a captcha - rather, it's a picture that a bot cannot scan and get the answer for. Only a human can look at the picture and answer the question. I've had 0 bots on my site since I started using it. You can see what I mean if you try to sign up for an account on my forum.

The second automatically scans the registration information (specifically user name, e-mail address, and IP address) against the database at http://www.stopforumspam.com. If any of them match, it prevents the user from even registering on the forum. They can't spam it if they can't get in.

Additionally, I have my forum set up so that all new users that get past these two anti-spam tools are placed in a special user group with very limited privileges. They're not allowed to edit their own posts (I've had some go back later and add spammy stuff), use signatures, or send private messages. All new threads and posts from users in this group must be manually approved before they show up on the forum.

If a user attempts to post spam, I delete it and permanently ban them. The nice thing is that I signed up for an account at stopforumspam.com, and when I ban a user, the Spam-o-matic plugin automatically submits their information to the anti-spam database so that they can't crash other forums that use the plugin.

Once I'm satisfied that a user isn't a spammer, I promote them to an approved user group that has normal forum privileges. The promotion is manual - I do not have the option turned on to auto-promote anyone after a certain number of posts, because users can get around that. This works well for me, since my forum traffic is minimal, and I don't get that many new users per week.

I used to get 20-30 spam posts per day that I had to manually deal with. Since I put these measures in place 2 months ago, I've had only 4-5 during the entire 2 months. And none of those 4-5 were ever visible on the forum to other users.