Has my vB forum been hacked?

[hawork]

I do think that my vBulletin forum has been hacked. My server provider has told me that many of my users are receiving spam mails (Viagra, cialis,etc) and of course I’m not sending that kind of mails. ¿Is it possible that someone is using my users’s e-mail addresses to send these mails from my server? If the answer is yes, I would be very pleased if someone could help me to fix it. The first thing I’ve done is updating my forum to the last version but I still have the same problem.



I’ve closed almost all of my server ports with iptables (I think I’ve done it right). But I’m receiving the same mails from my server provider with my log’s extracts. The mails are been sent through port 25 and I’ve closed it (at least that is what I see when I list my iptables with iptables –L).



I’ve heard that it is possible that a bot had left some code in a vB php file and it’s running all the time but if I look at the processes that are running I can see nothing strange. Some processes from nobody but seems to be apache stuff. If I only could find that code (or php file)?



If someone could tell me anything I’d be very pleased.



Thanks in advance,