JavaScript Obfuscation – How to remove it

Well, this seems to be spreading very fast and growing to be one of the top threats this week, check it out: http://www.avgthreatlabs.com/webthreats/info/javascript-obfuscation/

AvgThreatLabs.com seems to be the only online scanner to detect it, alongside with Chrome browser and Google’s webmaster tools.

Ok, so here I pasted the malicious code output that you can see while looking at the page source: http://pastebin.com/2XfbytS4 but I still couldn’t find where it’s generated (not in index.php nor header.php, etc. so I’m thinking probably a .js file).

I had more than one infected site, so, I tried upgrading WordPress and the malicious code disappeared from the page, but Chrome and avgthreatlabs still identify the page as infected, I’m still not sure if it’s just that these tools haven’t updated yet or if there’s still an infection.

Any clues, insight or experiences appreciated, so maybe we can find a definitive solution.