No joy,

Another web address very quickly flashes up, possibly forwarding?

--------------- Added [DATE]1231718207[/DATE] at [TIME]1231718207[/TIME] ---------------

Okay,

They've changed my username, password and email address. Any way to recover/change them?

Try this, however if they managed to get back into your account you probably have some other issues at hand.
Pointless trying to revert your forums while others are inside. Make sure you clear out all files in your server that you don't recognize, change your ftp password and database password. Possibility is they are getting access from somewhere else.

Apologies for being such a newbie, where do I find tools.php?

When you download vbulletin from vb.com theres a folder called do_not_upload, it's in there.

If you have completely new files and your plugins disabled through the config.php file, and a completely new default style, then you may want to put in a support ticket over at vb.com.

Check your vboptions, site url/title and meta data. I think you will find the url to the badguy site is attached to one of these settings. If it is, you just need to go to your database and edit that field to remove the bogus code. This is a technique that site defacers use all the time.

Forgot, you can remove that hack in vboptions too...

Thanks for the help guys,

Tools.php helped once I got hold of a friends account details. The site is back.

The only problem I appear to have is another admin was deleted meaning all his posts have effectively been turned to guest posts. Any way to restore this?

Thanks again.

Restore the admin account with the same user ID and things should be back to normal.

Again,

A newbie response. Where/how do I do that?

(sorry!)