The attacker wants us to download a particular page from 2345.com frequently, which we should definitely avoid. In other words, we should block it until Mudcat has got rid of the problem. Of the various methods suggested above, I think treewind's is easist: just add those two lines to the "hosts" file. Thanks, treewind.

(Chinese Mudcatters who love 2345.com need some patience. As we saw, Max probably has a strong financial interest to reinstall his own "ga_social_tracking.js" quickly and permanently. He mey even find the services of a professional human ghostbuster worth their price.)