The first javascript stuff says this. The funciton takes is variable qlX (which is a period),then it replaces the .'s with % signs in the huge string and creates the script in unescape. Hope that helps somewhat in your decoding.

unless I am reading this wrong, it makes j = "ScriptEngineMajorVersion()+ScriptEngineMinorVersion()+ScriptEngineBuild+"j;"
I have no idea what the code does besides checking user agent stuff and your cookies for miek=1.

EDIT: found this site, has lots of info on gumblar.cn: http://blog.unmaskparasites.com/2009/05/07/gumblar-cn-exploit-12-facts-about-this-injected-script/

Sounds like this malicious little bugger moves you over to the gumblar.cn website, forces a PDF file download with an Adobe exploit, then searches for your FTP clients, grabs stored passwords, sends them home, then logs on to those ftp sites, and modifies your files.

So here's a question. Its all over the net that this malicious script is hosted by gumblar.cn, so why don't they get shut down?

My friend owns a hosting/reseller company, and when someone reports something as little as spam from one of his clients servers, he shuts it down until they fix the problem. If someone is intentionally doing this, he straight up deletes their account.

Also on a side note, he was pretty pissed this past weekend. Someone hacked into one of his major servers through SSH and deleted 75 VPS accounts on the partitions, all in about 5 minutes. He had to tell those clients they lost their databases, their backups, and pretty much everything that was stored on their VPS, so they weren't too happy. I told him to quit pissing off hackers and accept their fraudulent credit cards when they try to purchase a dedicated server.