one of my forums was hacked not long ago and this hacks we both have.
dont know if this help us .

ibProArcade for vBulletin 2.6.7
Inactive User Reminder Emails 1.1.3
Miserable Users 3.7.002 .
vBSEO 3.2.0
vBSEO :: Sitemap Generator 2.2

Please check if you have set chmd to 777 or any of ur directory in the public_html.if you have then its easily can be hack like defacement by uploading somefile in php.after chaning the chmd check there must be some file with strange name delete it .

--------------- Added [DATE]1218913961[/DATE] at [TIME]1218913961[/TIME] ---------------

ibProArcade for vBulletin 2.6.7 required chmd 777 on arcade soo its risky i guess

I did find the mysmiliesvb folder with 0777 permissions. The readme in the mod says it is required.
The user albums were moved into the file system and although the main folder is 0755,
every sub folder vbulletin creates is set to 0777
I found a 1x1 pixel image in the avatars folder but I cannot seem to locate it within file manager.

side note dude, my website & db was hacked a while back, maybe like year & 1/2 ago, I got in touch with my hosting company who checked the logs, and it ended up being FlashChat w/ vB intergration that they used to get in.... So if you are using systems outside vB that are intergrated into... Be advised of those as well, FlashChat is what got my site hacked.

All directories must be CHMOD 755 or higher security (meaning lower than 755, ex 750, 644, etc)

You cannot set CHMOD 777 on any files or directories because this makes the files world WRITABLE which is insecure

soo if any mod requires to set 0777 i recommend not to use it .have u lost any database of your site ?

Happened again, this time different person.

Have you followed all the steps outlined in this article?
How To Make My Forums More Secure

PAKIDIL, I recommend you read this before you continue to tell people not to install modifications with 777'd folders: Why chmod 777 is NOT a security risk

Such a pain. Thankfully they only changed the index. I changed passwords and such. As for the list provided, I did most.

Thanks for all your suggestions- we're still looking for the exploit.
The latest hacker placed text within the inlinemodform just above the threadlist table.
http://thebestforumever.com/front-desk/
Has also been doing index page defacing.
I suppose we'll simply have to back track and begin disabling plugins until it can be located.