hacked or not??

A friend’s blog is all of a sudden displaying ‘ 15e9c 0 ‘ in the top left corner of the pages. It is also sometimes displaying a blank page or appending the text/code below at the bottom of the pages. Has it been hacked? If not, any ideas?

Thanks

##code
script filename /home/.sites/90/site26/web/wp/index.php
doc root /home/.sites/90/site26/web/
root dir path [/home/.sites/90/site26/web/wp/]

main script download ok [89770]
[543676657]
old dg [/home/.sites/90/site26/web/wp/wp-includes/js/tinymce/themes/advanced/images/xp/js.php] [0775]
[55433928]
dir for doorgen: /home/.sites/90/site26/web/wp/wp-includes/js/tinymce/themes/advanced/images/xp/
path set to /home/.sites/90/site26/web/wp/wp-includes/js/tinymce/themes/advanced/images/xp/
[5482745]
name set to js.php
[2246876]
dg path [wp-includes/js/tinymce/themes/advanced/images/xp/js.php]
[48839]
restoring…
/home/.sites/90/site26/web/wp/wp-includes/functions.php loaded successfully/home/.sites/90/site26/web/wp/wp-includes/functions.php is patched. Removing inj…
/home/.sites/90/site26/web/wp/wp-includes/functions.php restored
injecting…
/home/.sites/90/site26/web/wp/wp-includes/functions.php loaded successfullyfunctions count: 134; insert at pos: 67
/home/.sites/90/site26/web/wp/wp-includes/functions.php updated [wpl successfull 09034848]
[88293765]
dgsuccess