My blog got hacked, help with decoding

Hi there, this is my first thread here and i didn't want it to be something like this but, we can't get what we want ....
So to the point - My blog(wordpres 2.5) got hacked, it was my hoster's fault. All my .php/.js/.xml files got edited (well not all of them, but most of them), the edition of ALL(in all folders - admin, plugins, themes and so on... ) the files took 2-3 minutes, so i'm assumig that he used a script of some kind.
This code was inserted in most of the .php/.js/.xml files


It's some kind of redirecting script, that redirects to something (adware/spyware/virii), still not sure what. If there is someone who can help me decode it and understand what is it doing i will really appreciate any help.

I can provide the php, that includes this code too if necessary.

sucks man.. download exploit scanner plugin and scan ur blog .. it will show the suspicious pages and provides a few instruction on how to remove the codes..

My blog was hacked and this plugin helped me find those malicious code.. also google marked the blog as SITE IS HARMFUL.. so better do this RIGHT NOW...

First thing i did was to take the blog down, it was exposed only 3 hours. Thanks for the advise i will scan it with the plugin, but first the hoster must figure all how did his server got hacked. I want to decode the js, so i can find out who is doing this and what's the spin here.

The javascript injection on your pages is obfuscated iframe. Any user sent to your blog will be silently (and invisibly) redirected to a exploit kit. The kit will try inject shellcode onto the visitor, and thus infecting them.

Could be a banking trojan, a standard bot for a botnet or some other random viri.

You have a unupdated script that was on your shared/hosting public html directory. Unless you remove whatever is outdated and exploitable, it will continue to be infected. Via remote file inclusion or a SQL injection.

All of the .php and or .html files was done in a second via a simple to make perl script. They had shell access to your site, probally a standard c99 or r57, it doesn't matter.

Your AV was firing detections not at the viri it attempted to land on your box. But the recnizable shellcode.
You dont really have to worry, they're most like scriptkiddies considering its REALLY easy to UD a exploit kit. Just get rid of the vulnerable script and youl be fine.