Close your site.
Download the whole site to your local computer and save it as a backup.
Get a new database copy from your host and save it as a backup.

You need to find files and codes that dosen´t belong to your installation.
You can take help from the attached file "fusionscan" , it is a very good tool, It will give you a quick overview if you your files have any trojans.

Check your custom pages for bad codes and if new ones have been created.

If you do not have a modified system you can delete your whole installation, save your config file first and download a fresh copy of the latest PHPFusion version.

Upload the new files, delete install.php/setup.php and copy your old config.php back to the folder.
Remember that avatars / photos that you have will also be deleted, they are stored in your images folder for v8 and in respective Infusions folder for v9 unless you use 3d party Infusions.
Do the same with any 3d party infusions you have, make sure that you have the latest version available, mind your data so you do not accidentally delete data in folders you intend to save.

Change your passwords, MySQL / FTP / Site & Admin logins.

If your PHPFusion version is below 7.02.06 [7.02.07 presently] you need to update your PHPFusion version to latest v8 or latest v9.
If your host have a older version than PHP 5.3.4, it´s strongly recommended that this also get´s updated.