[TheLastSuperman]

- Upload 100% fresh files from a brand new vbulletin .zip (download the exact same version you're on now, once you fix the exploit/virus you can then upgrade but not before).
- Check to see if you're using a version that's still utilizing an outdated and prone to exploit swf file: http://www.vbulletin.com/forum/forum...ecommended-fix (if so then use this: https://vborg.vbsupport.ru/showthread.php?t=307008 )

It sounds like the filestore72 or 123 exploit from a while back, so basically you're only being redirected to malicious/porn/similar sites from the Google links correct?

- If no then its another exploit/virus.

- If yes upload fresh files like I mentioned above, then go to AdminCP > Server Settings and Optimization Options > User Remote YUI > *If that is set to google or yahoo or none change the setting to check, if changing to google or yahoo does not work try none and use local files (you just overwrote any bad files with fresh files remember) and no clear your sites cache, your browser cache, AND cookies - close your browser afterwords and DO NOT follow any bookmarks (delete those if you had them saved in browser and remake them)... now when you re-open your browser go to google and check the sub-links are they fixed?
-- If fixed now upgrade.
-- If not fixed then its more than likely not filestore72 or a variant.

*Also use suspect files in admincp > maintenance they could have dropped a shell script on your server, modified plugins and or edited one if not all of your .php files this could be coming from a base64 snippet in a file or in a template they added.
**Also in your browser, change your home page and make it https://www.google.com because its adding in the ?gws_rd=ssl in the url since your browser has the old url saved as your home page setting, they've since made that page https versus the old url which was http.
***Last * else you might die from over-use LOL no but seriously, Google does not normally give out virus/infected warnings unless something is actually up so from me to you, please never assume its a false-alarm or false-positive - always confirm else anytime someone visits your site, its your site that's placing them at risk.

http://www.vbulletin.com/forum/blogs...ve-been-hacked
http://www.vbulletin.com/forum/blogs...vbulletin-site
http://www.vbulletin.com/forum/forum...lestore72-info
This is not filestore however it shows an example of what might be added in .php files:
http://www.innovationbyinstinct.com/...um-and-admincp