I have a hacker on my forum couple months ago and I still dealing with the troubles he gave me on 7.3.1
I had this issue with CAPTCHA that was solved by Rick here:
http://www.ubbcentral.com/forums/ubbthreads.php/topics/229564/8.html
but seams that I still have a left over problem:
A user do the login, perfect.
then that user answer one question.
bing>>> the user is automatic log off AFTER the question being answer and saved. So it means the response will be there, on that user name, but the user is log off.

That accordingly to Rick, is the same problem that he pointed before, with one .PGP file having extra spaces before the PHP tag.
I finally finished checking ALL files and could not find any who still have that situation.
So, I'm start guessing that the problem is elsewhere.

My question: which files are involved on the process to respond one thread and keeping the cookies? (because my guess is that the cookies are being deleted during that process).

Thank you

PS: one more info:
it happens ONLY when the user stays connect for some time before answering a question. If the user connect, and then answer few questions, the problem do not happen.
THen he stays quite, doing nothing, for about 15,20" and then answer a question: bum... log off.

Okay, I remember your posts.
It seems to me it is time to do some housekeeping since your files keep getting hosed.
You can start with the control panel and delete any and all access to the control panel including changing the password for yourself.
If there is somebody you really trust then change that persons password.
Next change your MySQL user and password setting.
Next delete and or change all ftp accounts.
Finally change your master account login with your host.

You need to do this all at once because not knowing what access somebody has they may get to something while making the changes.
Once that is done then try some fresh files and see if something happens.

Then follow Ricks advice to look for datestamps on changes.

Ruben,
thank you for the housekeeping ideas, but the site is safe. It was some hacker that exploited a know issue that was already fix on the UBB forum.
nobody is hacking it any more, but I still have those disgusting left overs from that attack
Any ways, I did all this when I recovery couple months ago:
1) changed my password from the control panel (I'm the only one accessing it)
2) changed username AND password for the mySQL database.
3) deleted the FTP account that I was using to access the server.(created a new one).
4) the master account login is changed every 25 days, plus or minus 3.

The files there are already fresh, from a .ZIP, plus some small changes Rick did.
THe only file that is old is the language file, that I went trought very carefully, checking one by one, to make sure that the Portuguese files I have there are not corrupted.

So, this is why I'm surprise that I still have this kind of issue there.
Do not know where else to look for clues.