[Kaelon]

This is a good first step, but your code example is incorrect. It should read:

FIND:

if ($bbuserinfo['nosessionhash']==1) {
$session['sessionhash'] = '';
}

REPLACE WITH:

if ($bbuserinfo['nosessionhash']!=1) 
{
$session['sessionhash'] = 's=' . $session['sessionhash'] . '&';
} else { 
$session['sessionhash'] = '';
}

// vbulletin default
// if ($bbuserinfo['nosessionhash']==1) {
// $session['sessionhash'] = '';
// }

Otherwise, the Sessionhash will always be displayed. Erwin is right, though. This does not take into account $sessionhash[sessionid] - which is fairly prominent. Do you know where this variable is being defined?