deny access to a certain location nginx

Question

In my nginx error log is the following message:

FastCGI sent in stderr: "Unable to open primary script: /www//vb/showthread.php

My site is not made with vb and so I want to deny any requests to /vb/ how can I do that?
I experimented with

location /vb/ {
deny all;
}

but I still see many such errors in my error log, it looks like spam requests.

How can I also prevent access to /wp-loging.php and such?

I find the double // in the error log strange and I can't understand it.

here's my server config:

server {
    listen       80;
    server_name  www.domain.com;

    #charset koi8-r;

    #access_log  logs/nattiq.access.log  main;

    location / {
        root /home/www;
        index  index.php;
        try_files $uri @rewrite;
    }
    location //vb/showthread.php {
         deny all;
         }
         location /wp-login.php {
              deny all;
              }
    #error_page  404              /404.html;

    # redirect server error pages to the static page /50x.html
    #
    error_page   500 502 503 504  /50x.html;
    location = /50x.html {
        root /home/www;
            proxy_http_version 1.1;
proxy_set_header Connection "";
    }

    # proxy the PHP scripts to Apache listening on 127.0.0.1:80
    #
    #location ~ \.php$ {
    #    proxy_pass   http://127.0.0.1;
    #}

    # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
    #
      location @rewrite {
rewrite ^ /index.php;

}

    location ~ \.php$ {
        root /home/www;
    #    fastcgi_pass   127.0.0.1:9000;
 fastcgi_pass unix:/var/run/php5-fpm.sock;        
        fastcgi_index  index.php;
            fastcgi_param SCRIPT_FILENAME $document_root/$fastcgi_script_name;
        include        fastcgi_params;
            fastcgi_read_timeout 150;

Answer 1

The double // is because of SCRIPT_FILENAME, which should actually look like this:

fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;

Rather that trying to block individual .php files that do not exist, you should prevent any fake .php file from being transmitted upstream by the addition of one line at the top of the location ~ \.php$ block:

try_files $uri =404;

See this document for details.