After having timthumb.php exploited.
The site was upgraded to WP 3.5
It was compromised again, (wp-config included encrypted data as well as the functions.php in the wp-include directory.
After reviewing various sites, I opted to remove ALL files (after backing up the site) and reinstall the code to insure no corrupted files, and to remove any unneeded files still lingering from the various theme/plugin/and versions of WordPress updates.
The home page loads, but all links beyond that are unusable, giving this error
Fatal error: Call to undefined function get_header() in ...404.php on line 1. The Header and 404 php files are in the root of the theme's directory, and there is not modification of the code.
I've wiped the site clean twice now, and extracted the 3.5 install and theme back onto the site to ensure correct file placement.