In my site with Drupal 7 spammers create a new block. What can I do to stop this?
- Update Drupal to the latest version withing the major. (Drupal 7.43 is the latest for 7 major. https://ftp.drupal.org/files/projects/drupal-7.43.tar.gz)
- Delete the users that spam.
- If admin (uid 1) account was used to spam, change password. Check if email has been hijacked. If a wrong email is specified for admin user (uid 1), change it to yours before changing password.
- If your site allows other users (a social network), check user permissions if they are allowed too much.
- If you conclude that your site has in fact been seriously hacked and none above works, bring in a specialist to handle your specific problem.
There is also a walkthrough "Your Drupal site got hacked, now what?" at Drupal.org: https://www.drupal.org/node/2365547