Take the server offline first, then if possible restore from a backup. Also change all passwords and contact your host. You should make sure your server is secure, as well as all computers connecting to it. It's possible they hacked/infected your PC first to get to your server login info.
Either they cracked your password into the reseller account and got into all the sites that way, or the hosting provider has had a problem somewhere..... Is there a forum for this hosting provider, perhaps others have also been hacked?
Also, ask hem to check their access logs around the time tht that hack occurred so they can see what exactly happened.
Can you check the db, is it intact? If it is and it is not infected then all you have to do is clean up your index and all the other forum files by overwritting them with a fresh set from the package of your version. If you already have not upgraded to the latest version, then do so a.s.a.p. This goes for any other script that you have installed in your server.
Then do a thorough check up of your server space for any suspicious file/s that shouldn''t be there. Another thing to consider is to scan your pc with an antivirus program and then change all your passwords.
this is what my hosting company sent me.. Results for 184.108.40.206 :
% This is the RIPE Database query service. % The objects are in RPSL format. % % The RIPE Database is subject to Terms and Conditions. % See http://www.ripe.net/db/support/db-terms-conditions.pdf % Note: this output has been filtered. % To receive output for a database update, use the "-B" flag. % Information related to '220.127.116.11 - 18.104.22.168' inetnum: 22.214.171.124 - 126.96.36.199 netname: ADSL-3 descr: Assigned for ADSL customers descr: ORANGE-JORDAN remarks: ===For abuse contact mailbox email@example.com === country: JO admin-c: NI146-RIPE tech-c: NI146-RIPE status: ASSIGNED PA mnt-by: GO-JOR source: RIPE # Filtered person: Nazik Irshead address: Orange - Jordan phone: +962 6 5805205 fax-no: +962 6 5850102 mnt-by: GO-JOR nic-hdl: NI146-RIPE source: RIPE # Filtered % Information related to '188.8.131.52/18AS8376' route: 184.108.40.206/18 descr: Jordan Telecom Group ( Orange) descr: City Center Building, 1st circle, Jbal Amman descr: P.O. 941477 Amman - 11194 descr: jordan descr: Tel: +962 6 5805205 descr: Fax: +962 6 5850100 remarks: =============================== remarks: Jordan Telecom Group -Amman/Jordan remarks: Route 1 remarks: ================================= origin: AS8376 mnt-by: GO-JOR source: RIPE # Filtered