Badware report! Hacked?

My blog is about the little hacks I do every day. Like wikipedia's definition #5 of the verb hacking:

• #5. (computing) To accomplish a difficult programming task. He can hack like no one else and make the program work as expected.

Yes, that's my hacking. But today I think I was hacked, sadly with the definition #4 of this term:

• #4. (slang, computing) To hack into; to gain unauthorized access to a computer system (e.g. website) or network by manipulating code; a crack.

I received an hour ago an email starting like:

Dear site owner or webmaster of (mysite),

We recently discovered that some of your pages can cause users to be infected with malicious software. We have begun showing a warning page to users who visit these pages by clicking a search result on Google.com.

...

In fact, if I do a google search that lists my site, it says below "This site can harm your computer". And if you are brave and click the result, an awful page with a big and red Warning! message stops you explaining my site is going to harm you...

It turned out that somehow, I got injected a couple of script tags in some pages. They were an obfuscated javascript code, starting like this:

FBE38="parseI";FBE38+="n";FBE38+="t";DD6EDCFB9FEE="St";
DD6EDCFB9FEE+="rin";DD6EDCFB9FEE+="g.";DD6EDCFB9FEE+="fro";
DD6EDCFB9FEE+="mC";DD6EDCFB9FEE+="harCode";
function F5304B9279(C5F40D2E4C)
....

Well, a fun hacking (definition #5, for us good hackers) exercise is to decode that. I am not going to post the entire code here. It did some wrapping around parseInt(_,16) and String.fromCharCode to build a kind of evaluator of a piece of javascript code, encoded as a very long hexadecimal string. Then, when evaluated, it inserted an iframe linking to a place hosted in hostsads.cn domain. I don't know what they inserted in my page. It might be invisible, it might be harmful and exploit some browser vulnerability.

Scripts removed, passwords reset, a form filled into google for my site to be reviewed and the warning removed.

But.... Did anyone have the same problem? Do you know what they do exactly with the injected iframe? I could find this problem by googling around -- I would love to hear if anyone have seen it.