Recovering from a Hack

[Wir3tap]

So a few weeks ago some great help got me in with Fix It to fix our forums. There are still problems we are running into.

1.) When going to update plugs and enable them. It acts like its going to but gives this in the box.
Updating style information for each style

World at War ... (Templates) (StyleVars) (Replacement Variables) (CSS) ~ HaCkEd By EjRaM HaCkEr ~ isecurity7@gmail.com

That hacked by ejram is the hack that kept spamming our main page before we used fix it.

2.) If I try to run the vbulletin upgrade script. It says this.

On Processing Blog 17 of 18 It errors out with this message.

Unexpected Text:
<?xml version="1.0" encoding="windows-1252"?>
~ HaCkEd By EjRaM HaCkEr ~
isecurity7@gmail.com


Does anyone know where this hack could be?

Otherwise the forums are working just seems like updates can't be done.

--------------- Added [DATE]1375646712[/DATE] at [TIME]1375646712[/TIME] ---------------

Also, The only way we can view the forums, is if all of our plugins are disabled.

--------------- Added [DATE]1375647598[/DATE] at [TIME]1375647598[/TIME] ---------------

Ok I disabled every plugin, and removed the define('DISABLE_HOOKS', 1); from my config file. Now each time I go to enable a plugin it gives me this:

Updating style information for each style

World at War ... (Templates) (StyleVars) (Replacement Variables) (CSS) ~ HaCkEd By EjRaM HaCkEr ~ isecurity7@gmail.com

--------------- Added [DATE]1375648135[/DATE] at [TIME]1375648135[/TIME] ---------------

Ok Plugin - Everywhere Sidebar - Posted teh big white screen of the hacked message on main index.php or any of the site links. I have uninstalled this plugin, but still getting the Hacked messages for the Updating Styles