[knutae]

Running a hash function directly on a hash makes little sense. You probably meant:

    md5(md5(password) + user_salt)

[buro9]

[edit]I'm wrong, you're right[/edit]

Just re-checked... the line is this:

    md5(md5($vbulletin->GPC['password']) . $vbulletin->userinfo['salt']))

I got confused by the last bracket closing an outer conditional.