Have my sites been attacked?

My bet says your theme files were writable and that the server on which your site is on was compromised by a script kiddie.
The hosts will probably deny it and blame WP.
Change your file permissios to 644 if possible, including themes.

Nathanwburke, I had this same thing happen to me just the other day, but on my site that has WordPress Multiuser. So far I only spotted that it had added a file to /wp-inst/ and added the lines you mentioned to /wp-inst/wp-conig.php at the end of the file.

My friend who has a blog on my site alerted me to the problem when he got error messages on the site, but also a virus warning.

Thanks Podz, for the suggestion, and I will do that to my site, but actually none of the themes were effected by the hack.

UPDATE —

Took podz advice on changing permissions, but for those with WPMU the wp-inst folder still needs to stay as 777, make absolutely sure that wp-config (which contains your database password) stays with the strictest permission, basically allowing only reading from the server is best, I think.

I had a similar incident – removed permission – things seemed to have returned to normal !

The same thing happened to my site. The active theme and one other both had the iframe code added past the body tag. The index.php it calls run javascript to download an app.wmf that Norton id’s as a Trojan download. Changing the file permissions has fixed it for now.