[phpmattk]

How did he 'encrypt' his code? If it wasn't with ioncube or somthing like that, its probably a simple rot13'd chunk evaled, find in his code where he uses an 'eval' call and change that to 'echo'. voila, unencrypted code. Then maybe you can find what you need to find in there.