Ok I remembered even more after I ran off to another thread so back to share! See my post here as this is a very similar situation and check for those plugins I listed or similar ones.

http://www.vbulletin.com/forum/forum...31#post4012531

I have 1 hour of spare time, you may PM me your Teamviewer information and I'll take a look for you.

You need to follow the instructions in the blog post I linked you to. It don't matter if it was not like this yesterday, they could have loaded the scripts months ago. Now they finally decided to act on them.

Follow the instructions, and upgrade to 4.2.2

If you decide to take the easy way out, you will just be hit again, as the site is now on their radar.

It depends if that was indeed the hole and what he did while inside. An easy way to see exactly what he did is to look at your server logs.

The shout is most likely a old version that was re released by a hacking team, and I won't mention their name. :)

Also the vB version being run has un patched security issues, as does any version below 4.2.2

Another thing it could be the install directory was still in the root.

Either way, the OP needs to follow the directions in the blog posts, then upgrade to 4.2.2

I know that hacking team only too well. :(

Yep, I agree to stick with the plan though I didn't read it. lol Was just saying to check server logs. it is one of the first things to do upon being hacked. :)