[Attilitus]

Right vbulletin stores passwords as salted md5 hashes. What this means is that for each user a random string is generated ("abc" for example) and is stored in the database under their username as a "salt." When they register and enter in their password it is "salted" with the random string before being hashed. So Password becomes md5(passwordabc). Then when a user logs in what they enter is hashed in the same manner with the salt appended to the end.

So there is no way to compare user's passwords as each user has their own individual salt associated with their username.