Originally Posted by
ricktas
A bit of a search from me. Is your friend's website a wordpress one? Cause it seems the hacker who goes by Haxorstein BD has developed a cybr-root kit for hacking wordpress sites. So it may not be that hacker as such, but someone else who has using his/her hacking kit. They also seems to have some links to Anonymous as they have posted on several anonymous related pages.
Your friend might need to seek the help of the web developer who built her site (if she used one). If it is a wordpress site and she can get access, she should be able to change the passwords and then delete everything and set it up again.