It won't be until at least this afternoon before I can start removing it.
This injection attack seems quite complex compared to most site hijacking automated scripts.
Lots of sites are getting hacked in recent days, and not just vBulletin, but also WordPress, Joomla, and lots of others including popular ecommerce sites.
No one has yet worked out how they are gaining access, but some think it is gaining access from an admin account loggin. Then uploading a load of files in a buried location on the server by installing bogus plugins on the forum or cms software that then uploads their files.
These files contain a JavaScript based malware payload (not Java), so ensure you have a way to control JavaScript running per site.
In addition the attack injects a line of PHP code to the top of every php file on the site. So when anything accessed an injected/infected script the hash included in the injected code translates into a redirect to the hidden payload files to run the malware, and then redirects to a random domain holding page.
.
