[kh99]

I think you might want to check your plugins and see if you have any that use hook ajax_start or ajax_complete - the ajax.php file itself doesn't use the global parameter so something else must have been processing the command (I suppose it could have to do with vbseo - I don't know how that exploit worked).

Edit: BTW, here's an older thread discussing the issue: www.vbulletin.org/forum/showthread.php?t=202532 ...and if what was said in that thread is true, ajax.php isn't the original problem, it's just where a "back door" was added.