WordPress MU

This seems to have happened rather suddenly: my admin panel has broken.

I was working on a plugin the other night, checked everything made sure it was all working, I uploaded it, checked everything was working and it all seemed fine.

Then today I find my admin panel is completely broken: http://i.imgur.com/Mklzo.png

I disabled all plugins, including the one I've uploaded and it's still broken like that. The thing says 'done but with errors on page' and I'm suspicious the javascript is not working because the errors are and I also get 'This widget requires JavaScript' in the pain admin page:

Webpage error details

User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
Timestamp: Tue, 30 Mar 2010 05:49:00 UTC

Message: Invalid character
Line: 1
Char: 11
Code: 0
URI: http://mysite.com/wp-admin/load-scripts.php?c=1&load=jquery,utils&ver=d24248fe4b0cd62086633fd42ef1019b

Message: 'jQuery' is undefined
Line: 9
Char: 1
Code: 0
URI: http://mysite.com/wp-content/themes/bp-sn-parent/_inc/js/jquery-livequery.js?ver=2.9.2

Message: Object expected
Line: 3
Char: 1
Code: 0
URI: http://mysite.com/wp-content/themes/bp-sn-parent/_inc/js/ajax.js?ver=2.9.2

Message: Object expected
Line: 1
Char: 1
Code: 0
URI: http://mysite.com/wp-content/plugins/buddypress/bp-core/js/widget-members.js?ver=2.9.2

Message: Object expected
Line: 1
Char: 1
Code: 0
URI: http://mysite.com/wp-content/plugins/buddypress/bp-groups/js/widget-groups.js?ver=2.9.2

Message: Object expected
Line: 1
Char: 1
Code: 0
URI: http://mysite.com/wp-content/plugins/buddypress/bp-core/js/admin-bar.js?ver=2.9.2

Message: Invalid character
Line: 1
Char: 2
Code: 0
URI: http://mysite.com/wp-admin/load-scripts.php?c=1&load=hoverIntent,common,jquery-color,thickbox,plugin-install&ver=4da0deb0a407cab08206119384f165aa

Find the error logs on your server and give them a read too.

OK I just found out virtually ever php file which is part of my core wordpress install had a base64 bit of code right up top.

When I decoded it in a base64 decoder I discvered it was referencing *another* encoded function in a file called 'style.css.php' in a seperate blog install entirely (and a rather old one).

So clearly I was hacked.

I'm working on removing the base 64 crap from my current eader files, when I deleted the directory of the old wordpress install which the function was referencing the admin panel started working fine.

How did this happen? Should I be worried? File permissions for my wpmu install are 644 for files and 755 for folders.. which is the default one. Should I change them for safeties sake? Since I deleted the offending blog install which contained the dodgy code am I safe now?