vBulletin encrypted passwords

[Dismounted]

This is how vBulletin encrypts passwords:
String (eg. test)
MD5 The String (098f6bcd4621d373cade4e832627b4f6)
Add Salt to End of the Hash (If salt is 1234 then the result would be 098f6bcd4621d373cade4e832627b4f61234)
MD5 The String w/ Hash (260cac331a7b9d4416cd11146d39b33d)

That's how I remember it, feel free to correct me. The salt is a random string determined at registration. It is located in the table "user" in a field called "salt".