Hi Wingers. Any chance you could see why I can't upload an avatar? There's a thread in comments...
can you not make the template files read only on the server and then turn off FTP for the site? If the files are read only vBulletin can't update them (if it is a vBulletin exploit), and if FTP is off then any exploit has to be the actual host machine having been hacked (which you can't prove).
Where are you hosting this anyway?