1: Your forum root folder is the root that I'm talking about. If your forums are located at
www.example.com/forums/, then the forum root is the
/forums/ directory. You must upload all of the contents (files and folders) of the 'upload' folder into your forum root.
2: All files in a default vBulletin installation are publicly accessible. There's no reason to make the files private as long as there is no room for an exploit. Since these files contain the plugin code and nothing more, it would not do anyone any good to try to access these files. Therefore, no .htaccess is needed.