[TheLastSuperman]

If you have vBSEO installed this is very likely, could also be from the recently discovered install directory exploit we are unsure without actually investigating it ourselves.

Try running the queries listed on my blog post scroll down to find "Run the following Queries in phpMyAdmin" and do so - http://www.vbulletin.com/forum/blogs...vbulletin-site

Some basics:

1. Start off by replacing all files with 100% fresh vbulletin files of the exact same version.
2. Next run queries listed on the blog and investigate all that come up. If your not running a custom style then first delete any malicious plugins/templates and you can delete the default style and remake a new one (create a new style after removing the malicious plugins etc then delete the old one otherwise your primary is the default and it will not allow you to delete etc).
3. Next check filesystem - AdminCP > Maintenance > Diagnostics > Suspect File Versions and check to see what is listed, cross reference that via FTP and inspect file dates etc; Anything named odd should be investigated i.e. sexy.php, lol.php anything seemingly odd however not all hackers are so apparent they could have named it crontools.php or something you would if not 100% familiar with the product assume was a normal file so take your time checking.
4. Once you feel its clean, either create or login your Google webmaster tools and request the site be checked, once they verify its clean you're normally good to go.