Best Way to Upgrade from WP 2.8 (!)?

The virus part is going to be off-topic, but yes a fresh install is the way to go.

What I would do to upgrade the site is:

1. Backup everything– PHP and database
2. Install the old site on a development server.
3. Before running the site, replace all of the core files with new 2.8
   ones from the archive. This will hopefully fix the suspected virus problem.
4. Then start updating release by release until you get current. Do not
   try to leap-frog over more than one or two minor releases.
5. Then you can fix anything that is broken. Unless the original site
   is running hacked core files I don’t think this step will be too
   much trouble, though you will have Notices to fix and perhaps a
   few other things.

The reason I recommend upgrading release by release, rather than trying to upgrade all at once, are:

1. Personal experience
2. I’ve seen a lot of issues over on the wordpress.org forums
   apparently caused by jumping too many releases
3. There is note in the Codex to this effect “… it’s okay to skip one
   release, but never skip TWO when upgrading.”

I have looked at the
upgrade code and, yes, it seems like WordPress should upgrade itself
over multiple releases but does not always appear to do so
correctly– perhaps issues like timeouts get in the way.