s.php hack
PROBLEM: You're site has been trying to load a php script called s.php from an unknown IP address.
SOLUTION: Look for compromised (altered) Javascript files (jQuery, SWFObject, etc.) on your server that your site is loading. You'll be able to tell when a file has been compromised by the fact that this Javascript code snippet is at the bottom of the script.
SOURCE: http://wordpress.org/support/topic/jsagent-warnings-in-avg-nightmare-hack-in-multiple-wordpress-sites














