So he just put in a remote shell and removed the actual code? I've found a couple remote shell scripts on my server over the years as they got compromised, I was always impressed with how much they could really do from 1 file to my server. Scary stuff.