Yup. And as someone said above, they need to do it soon, or Google is going to blacklist the site (the big red "WARNING THIS SITE IS COMPROMISED" page). I had that happen to a site of mine one time when malicious code got inserted--it's an incredible hassle to get de-blacklisted.