I used this http://www.web-code.org/coding-tools...rter-tool.html to see what was your code doing. (There's a "simple unescape" button).

The URL decoded has an iframe, pointing to a php page. The iframe is set to "display:none", so you don't notice it.

I guess that this php will try to download some malware when invoked, but haven't tested. There's a mozilla plugin, noscript, very useful to avoid "bad scripting".