KLH hack on WordPress site. Advice needed

A friend’s WP site has been hacked by KLH. The front page has been replaced. Trying his login id didn’t work. Hope this didn’t change passwords (although I know the password recovery tool here does work)

Any advice appreciated. I couldn’t find any info about KLH here or by Googling.

Here’s the site.

http://asymptoticlife.com/

He hadn’t updated it in a few months however has put much work into it.