[knucklenitz]

Would someone be willing to review my access log listing with me to determine if there are clues in how they got in?

One thing that is strange, I have a log, somehow, that shows they did a search of my host IP to see what other vbulletin forums were hosted there. I'm now wondering if another forum was hacked and they got in some backdoor to mine. Prior to that, it looks like they hit the index, then the registration. Regristration is disabled. They then hit the login and index and then the other entries look like they were in to the site. Since a few minutes later they hit my admin and mod cps that had names changed, they somehow must have been in the database or broke in through another server.