[Pyrix]

Just thinking, you may be able to secure it a little more by appending the vbulletin license number (or a random string stored in vb options) to the character before you hash it (both times). This is known as 'salting', and would make the 'MD5 hash table' bypass much, much harder. You might want to Google that and read up on it

Don't know what you can do about the other thing though - you could turn it into an image but then what advantage does it give over vb's default captcha?