If he had FTP access he could have uploaded a script anywhere to give him complete access to everything.
The only way you could be very sure is to delete all the files everywhere on your site and re-install.
Then in vBulletin (the info is still in the database) either manually check every single plugin or just uninstall every product and re-install only what you need. (and can confirm is from a trusted source.)
|