Please help site hacked

[stryker2012]

I notice today when two members made posts about their donations.

I checked my paypal account and there's was $0 , so I told them double check and they
send me a transaction confirmation ID, I was using vBDonate plugin for donations,
so I checked the setting and the paypal email was changed to a different email.

I started to check everything and find when I click on ranks in the admin cp
I get this:

http://postimg.org/image/7cfz7pie3/

It has been almost 6 hours I've trying to figure this out reading and doing some other stuff
and I still can't get rid of it.

I was using vb 4.1.10, I upgraded to 4.1.12 thinking that will fix the problem and still there.

Any help will be greatly appreciated.