Originally I posted a big long explanation of this and what steps to take - but the forum crashed and I lost the will to live. Hope you fixed it OK it is likely a variant of SmitFraud / Vundo.