How can I tell if I've been HACKED?

[Orp]

I'm running vb3.09. Trying to upgrade but haven't had time or a test server so I didn't want to mess up my live one.
My VPS has been down twice in the last two days. At this point I've been down for over 8 hours. I cannot SSH in, so I've contated my hosting provider (MidPhase). 1st time I was on hold for 1 1/2 hour, never talked to anyone. I've sent emails to no avail.
These guys used to be very good, but I have to wonder if part of the problem might be that I was hacked. Whenever they have rebooted my VPS it takes two hours to do the file system ck (according to the MidPhase rep).
I don't know if this is a symtom of being hacked or not.
Can you all tell me what to check once I am back up to see if someone is messing with our site?
The site is down now, but I'll post a link and hope it will be up soon ...so that you can take a look if needbe.
www.forumsforums.com/3_9/

TIA!

[Steve Machol]

If you cannot SSH in, then tthis is an issue that you need to bring up with your host.

[Orp]

Thanks for the reply Steve. I could not SSH in because the VPS was down.

When we came back up one user, and one user only saw a screen that had 'subway' icons to the left of 3 posts. No clue how they got there.

I've review all admin & mod actions. Nothing out of the ordinary. I've checked all logs on my server (VPS). All appears okay.

I'll attach a screenshot ....any clue if this is just a user issue or do I have something to worry about?

TIA.

Sorry, I could not attach the screen shot. My doc file is to big, and when I put it in photoshop to make a jpg it is so small you can't read it.

[Orp]

Here is the screenshot. small but better than nothing.

[Steve Machol]

Sorry, I can't read that pic. What specific problem are you having now that we can help with?

[Orp]

Thanks again for your reply Steve. I was trying to show the 'Subway' icon one of my users had show up when displaying our forum. Since it was just one user, I believe we have narrowed it down to being a corrupted cookie issue on that one users machine.
Thanks for trying to help.