Thanks for the suggestions so far- to answer your questions....
As far as coming to conclusion that the site was hacked: I received a few complaints from students saying that they could not access resources- they would click on something and they would just get a blank page. The logs confirmed that they had repeatedly tried to access the page. After playing around with the site I also noticed that occasionally a blank page would load after clicking any link and I would have to go back and click again. I then accessed the page a varsity and that is where Trend Micro blocked the URl. I then deduced that I was hacked after reading the following forums.
I never ever found additional code added to either the index.php or config.php files as suggested by other forums. The solution was always the same- restore to an earlier backup- so that what I did. Now I've tried starting from scratch.
As far as where I got the Anti Virus programs- My Trend was from a CD as part of the computer. AVG was from the AVG site. As far as fresh file- this last time I installed Moodle from Fantastico on the site from a computer in the lab at varsity (trying to eliminate my computer as a possible source). I've only had the problem with Internet Explorer. When using Chrome I would occasionally get the blank page problem but no URL blocked warning. I also occasionally got a something along the lines of an "invalid parameter" error from Moodle when I would try save settings. I've never had a problem with Mozilla on my laptop. The blank page appearing/URL blocked warning seems to be totally random- I could have entire session without it happening, or in the case yesterday it happened 4 times with completely different links (such as clicking add new course ect..).
As far as the hosting company- its not free and they pretty decent. The support desk there suggested it was Gumblar - gave me a whole lot of reading material and have already changed all the passwords. I will check my PC with the other AV software suggested by Cor.
Finally the URL's it tries to direct to are scanonlinedirect.com and goparkscan.com. I have googled said addresses- I have not experienced what they have described (screen saying my computer as risk I need to click here).
Thanks for the suggestions so far. I appreciate your input...