Major security issue, any help?
 

Few days ago someone has done something and managed to redirect couple of urls on our site to his phishing site which looks exactly the same but on different url. We were running vb3.8.2
I thought it might have something to do with not installing patches. My updates rights have expired and latest I could download is 3.8.3 so I installed it and uploaded patches for 3.8.4 since files don't seem to be too different and everything was working fine.

But today issue has reappeared. Two links that are being redirected are new posts:
Code:
http://www.mydomain.com/search.php?do=getnew
and from quick links Today's posts:
Code:
http://www.mydomain.com/search.php?do=getdaily
They were redirected to:
Code:
http://www.fakesite.com/login.aspx?
which looked like exact copy of our site and I imagine someone was trying to steal login data.

Redirect is still on although phishing site is down, actually reports server error on that particular landing page. The base url is still working fine.

Any ideas please on how someone could have done this and how could I stop it ?
There is nothing in the templates mentioning this fake url. Didn't notice any files on server have been changed either. Tried disabling plugins but no luck.

I am a little low on funds to upgrade to vb4 atm, not that I am too keen on doing so even if money was no issue.