[syrus.xl]

Searching for malicious URL's normally will not give you the right answers.

Check under Plugins & Modifications > Plugin Manager then under Product: vBulletin look for any plugin with a hook_location of ajax_start. If you see anything there click Edit, if it looks like a load of strange characters it is probably the base64 encoded SHELL. Delete this ASAP

The previous poster suggested looking for 0px by 0px iFrames, this is one way SQL Injection may look in some source code or your templates, but it can also be hidden in your database. Search your database using phpMyAdmin, and use the following wildcards:

%base64%
%iframe%

The trouble with the iframe code now is it is ussed by vBulletin legitimately, therefore be careful. Any base64 is normally associated with malicious coding, and normally found in your Template table, and the datastore.

Sometimes you can remove such code just by resaving any template that you know you have not altered in anyway.