Sounds to me like a file was overlooked when you cleaned it the first time around... either a file is still present (shell script more than likely) or a plugin still within your database.
Follow these guides, by that I mean grab what you fancy red bull or coffee, sit back, read then have at it! Be thorough or don't even bother - no honestly you must be thorough no joke I'm saying that with much emphasis these days!
http://www.vbulletin.com/forum/blogs...vbulletin-site
http://www.vbulletin.com/forum/blogs...ve-been-hacked
http://www.vbulletin.com/forum/blogs...vbulletin-site