I'm having the same problem, these are new spambots that circumvent the Watchdog plugin.

Their registration also exposes a bug: I have avatar upload during user registration set to hidden in the User Settings panel, yet these spam registrations still manage to upload the  emoticon.

1. Daniel, can you provide screen shot of your spammers?
2. Which version of Oxwall do you have?
Regarding avatars, this is indeed strange. We will be able to check and help you more once you answer our questions.

i had at least 30 of these joining a day but then they just suddenly stopped 

I have 200+ joining mine. 

we get those too, had them for months, usually between 5 and 10 a day, i use user approve so they cant spam the site

Guys, can you attach screens of your spammers and your Oxwall versions?

Unfortunately I already deleted the latest batch before checking this topic again. But all the spam accounts look like the one from the original poster's screenshots (not like one right above me): the username is 20 garbled characters (letters and numbers, but also stuff like {, } and umlauts), and so far they all uploaded the exactly same avatar as shown in that screenshot as well.

Mine is a very low-traffic site, at the moment I get around 1 per day of these. The last one registered yesterday so I don't think it has stopped for me.

I run Oxwall 1.5.3 build 6341 with the up-to-date watchdog plugin.

Daniel, regarding your spammers.

We suspect that those are in fact real people whose job is to spam people and that avatar is added after registration is completed: spammer registers without avatar, but then adds it when editing the profile.

I will get back to you with troubleshooting steps for your site tomorrow ( Friday 27th).

Meanwhile,
1. Enable email verification.
2. Enable user approval.

This will help us to find out whether avatars are added during registration OR during profile editing.
If both features are enabled and our assumption is correct, your spammers will appear in your admin panel without avatars

Aliia, unfortunately this is not the case, I had e-mail verification, user approval and watchdog all activated at all times. The spammers verified their e-mail, but I always deleted them instead of approving their accounts, so they had no chance to log in and add avatars.

I have not had any registrations since my last post, so I couldn't look into it further. One question though: does deleting a user account also delete any avatars they might have uploaded? Because I checked ow_userfiles/plugins/base/avatars and the smiley avatars weren't there.

Deleting user account should completely remove ALL data related to that user.

Daniel, next time when you get those users:

1. Can you leave them ( don't delete)
2. Provide us your admin panel username and pass.

it seems like oxwallaccessories demo page is full of them http://kushkustoms.com/

Update:

To track down those spammers we will need:

- admin panel username/pass
- FTP access details

If anybody is willing to provide those access details, PM me.