[Floris]

Wow,
I am sorry to hear that. I do hope you can find and procecute the hackers/crackers or however those lame abusers want to call themselves.

Happy that you had a backup :> And I hope you find out that it isn't a bug in vB 2.2.5 :>

Take your time, because the current version we can download works just fine


[update 4 mins later]


Ah, I think I know what went wrong.
You have an old vBulletin version! vB 2.2.1
There are like 5 exploits out there for vBulletin, download vB 2.2.5 from vBulletin.com "Members Area" and upgrade A.S.A.P.! They probably did some cross site exploiting or maybe through upload exploit with php older then 4.1.2 (or whatever, see vBulletin.com announcements and php.net announcements) - If it was php, inform your provider.

Also, .htpasswd/.htaccess your /admin/ & /mod/ directory, so they can't exploit and then login as an administrator. Also, check the admin log and write down all the IP's. Maybe you also want to have a copy of the hacked board in .sql so you can go through that with notepad or ultraedit or whatever, and find IP's from users who just signed up, (and admin log) and compare those against the servers syslog.

vBulletin 2.2.5 announcement thread.
PHP Vulnerability -- File Uploads thread.

vBulletin.com members area
php.net Vulnerability security release (www.php.net for sources)


Hope this helps.