Only thing I can think of is he was trying to backdoor my Device an wanted to store some form of connectback shell or something that sort in the hidden file, thats really the only thing I can think of since I showed him how insecure one of the sites he built was.

Either way is sorted now anyway. Im just guna have to check what over files may have changed.