Not very common type of malware. Some URLs:
18.104.22.168/index.php .. a few more..
Those are often used to redirect the browser of exploit kits (Blackhole 2.0 and Phoenix).
Affecting: Any web site (no specific target).
Clean up: Nothing specific.
Last update: Sep/2012