http://www.theregister.co.uk/2010/07/23/vbulletin_vuln/ If you were on 3.8.6 and you didn't have a backup, you're basically screwed. I honestly wanna ask, why vBulletin?
Yeah, why vB? You cannot " unhack " a website, its simply not possible. There is no command or button called unhack, you have to manually go through your code and find the vuln. afaik, vb is in the death hole php wise and its developers dont seem to be on ball to manage such a large security risked forum.