[TheLastSuperman]

Originally Posted by RichieBoy67

Well it could just be an extra php file that a virus scanner would not catch. use the suspect versions under maintenance in the admincp and check those files to make sure they either belong to VB or the mods you have.

Exactly (cannot catch comment) the issue about that is, some of these files are custom coded per site or revised every so often so if it's a new script chances are your anti-virus is not going to detect it (server level or even your personal anti-virus if you download files from your server to your pc) HOWEVER this is why they have the Suspect Files maintenance tools in the admincp.

On the note of suspect files, you should always compare your vBulletin files to that of the original files within the .zip - What is different?

- Well the only thing that should be different is added files from modifications so simply verify those were not modified, compare your "supposedly stock" vBulletin files to the same files in a fresh copy of the same version you were running and if nothing differs i.e. the vBulletin files match (filesize and upload timestamp/date should all be the same if not within a minute or two of each other, timestamps can help indicate a malicious file too) that of those in the .zip AND all modification file sizes match then what remains? Chances are those are the bad files but remember to clone the directory before making changes or deleting files.