Hi Pondus,

This malware has been with us since 2009, examples: perm.aif.ru/i/js/translit.js & auto.sakh.com/js/translit.js and
i.li.ru/translit.js

Here avast flags: http:// jsunpack.jeek.org/dec/go?report=4163b2e64c8ac0da90d1ecdec63ba648c922c673 as JS:IFrame-AU[Trj]

polonus