Security leak: malware infected

[digif]

So, yesterday out of nowhere, google sent me a mail that they've blocked my forum because they found malware on my forum. If I try to visit it directly, both firefox and chrome also block the visit with that usual page and you have to ignore it to get to the forum. Of course, same is on google search engine too.

I've contacted my hosting provider and they've told me my version which is -3.8.4. patch level 2- has security leak and that my forum was attacked before but they've removed everything, this time it happened on March and google found out yesterday.

Hosting provider recommended me to overwrite all the files, but I'm unsure if I'll lose some settings if I do that with original vB files. Also, do I have to do the same with the plugins as well?

Even if I do that, how can I know it won't happen again? I can't download v3.8.9. but I can see on vbulletin.com that I can download 4.0.2. version patch level 11, but how can I do that if I haven't payed for upgrade?

The main question is bolded so please let me know asap what do I do, and will I lose some settings?