WordPress users: UPDATE! UPDATE! UPDATE!

I've just spent the last couple of hours or there abouts (wouldn't normally take that long, but I'm a sadist, so spent time analyzing each file), downloading/analyzing, more downloading, then uploading/re-setting-up and re-configuring a friends site, after his WordPress installation got hacked and a malicious script installed on ALL PHP pages, with a simple script format, placed in all of the .