It definitely wont be the ajax file, it's usually due to an add on poorly coded allowing access, if you have all the security patches for vb up to date for your installation then it will be from something else, do you have vbseo?
Check these too:
https://www.vbulletin.com/forum/entr...Forums-(Part-1)
https://www.vbulletin.com/forum/entr...Forums-(Part-2)
https://www.vbulletin.com/docs/html/securing_vbulletin
https://vborg.vbsupport.ru/showthread.php?t=193930