This doesn't look like a virus to me, per se. It looks more like you've experienced some cross-site injection attacks; which in essence are hacks. You need to make sure all your directories have the proper permissions and you need to properly validate all the variables inputted into your site.

In your logfiles look for http:// in your queries.

Here is a log example of a slightly similar type of attack. I've added a few spaces to prevent linking.

You should also check with your IT guy to make sure your server is properly configured to prevent such attacks. Make sure your forum is up to date with security patches and, as mentioned previously, validate all user input and take steps to prevent string query exploits.

__________________
I use Country IP Blocks as added security for my networks and servers.