They have left a backdoor in your system, there were many many people, in the past week, with similar issues because of a vBSEO hack which granted the attacker full access to the system.
Even if you were not hacked through that specific hole, there is little doubt these people have some backdoor. Check the world-writable directories, and make sure that ALL your products are updated to the latest version (please note that the patched vBSEO version is still called 3.3.2, but the patch was added just a few days ago without a version number change).
Check for php files you did not remember having in your directories, and use the vBulletin suspicious file checker to help with this (in your diagnostic tools in vBulletin ACP).
Until you do not cleanup properly, they will be able to do whatever they want to.
|