HACKED - redirect to Syrian army thing

[fmckinnon]

Hey Gang,
Looks like a BUNCH of hacks today ..
We upgraded to the latest release of 4.2.2 this AM hoping to resolve.
/install directory has been completely deleted.

Hack still happens - when you go to our forums, it redirects to
http://www.cadiroig.cat/ -- some Syrian army thing.

Any clues where the redirect is coming from? Like I said, we uploaded new forum files, upgraded the database, and removed the /install directory. I also disabled plugins.

Any help would be appreciated:
http://www.theworshipcommunity.com/forums/

Fred

[ForceHSS]

<a href="http://www.vbulletin.com/forum/blogs/michael-miller/3934768-recovering-a-hacked-vbulletin-site" target="_blank">http://www.vbulletin.com/forum/blogs...vbulletin-site</a>

[Spangle]

Hawhost told me by e-mail that my hack was done through a known exploit in forumrunner

[xenite]

Here, I shared details on the Syrian Army Hack in this other discussion:

https://vborg.vbsupport.ru/showthread.php?t=302033

This thread would have been more appropriate but I didn't see it.