I believe it's time to enlist some help to get this resolved. Earlier this evening our forum.php was compromised and is now suffering from some kind of redirection.
So far I've removed the /install folder, deleted accounts created today, changed admin passwords and replaced the rest of the forum directories from backup and still don't have this thing removed.
Please PM me as soon as possible if you are interested in being paid to resolve this.
http://www.treeleaf.org/forums/forum.php