He added malicious scripts to the bottom of a legitimate one? I have seen Wordpress hacks obfuscate themselves ten times as cleverly. For example, by eval()ing

He added malicious scripts to the bottom of a legitimate one? I have seen Wordpress hacks obfuscate themselves ten times as cleverly. For example, by eval()ing rot13(), gzipped, and base64()'d code included from a file with a legitimate-looking name.