[BirdOPrey5]

Unless you are skilled at looking through PHP code it is often easier to just re-run an upgrade of whatever version of VB you are running and then reinstall (overwriting original products) all the 3rd party products you have. Doing both will replace all the original and add-on VB files and plugins with their original/clean versions.

You also need to check Plugin Manager to see if you have any plugins listed at the top under the vBulletin product- if so treat these as suspicious and disable them unless you are absolutely sure what they do. VBulletin would not normally have any plugins listed under the vBulletin product.

Also you need to check your server for any additional files uploaded by hackers. Check especially for php files in image and/or attachment folders. There shouldn't be php files in these locations.