Avast should detect JS:Autolike-Q [Trj] on this website.

Viruses and worms
1

See: This is a suspicious page
Result for 2015-08-10 21:16:44 UTC
Website: -http://alotuyensinh.edu.vn
Checked URL: -http://alotuyensinh.edu.vn/
Trojans detected:
Object: -http://alotuyensinh.edu.vn/
SHA1: db8ebded35762737c1d7a10626a70e4e03b4a701
Name: TrojWare.JS.FaceLiker.DFS
Re: https://www.virustotal.com/nl/url/0735fce7e37d38aae7ef320f7e6319c8cc809d74d63f8dca8ce0dca261d527ec/analysis/
Sucuri misses it or has the site been cleansed? → https://sitecheck.sucuri.net/results/alotuyensinh.edu.vn
Quttera has the domain and external links blacklisted.

See vuln.: http://www.domxssscanner.com/scan?url=http%3A%2F%2Falotuyensinh.edu.vn%2F
-/themes/default/js/floater_xlib.js is known to be exploitable and then malicious.
The other two scripts there also flagged here: https://urlquery.net/report.php?id=1439243669705
Read for instance here: http://www.exedb.com/systemfiles/sliderman.1.3.6.js.html
Warning: mysql_fetch_assoc() expects parameter 1 to be resource, boolean given in /wXw/htdocs/w00ff319/domain.php on line 1026

polonus

As predicted we have protection via the shields - Avast flags and blocks JS:Autolike-Q [Trj.

2

Zulu Zscaler is somewhat more revealing for malcious links found up there: http://zulu.zscaler.com/submission/show/5257fc9be25c71b990454caa02b45745-1439244515
See: http://www.domxssscanner.com/scan?url=http%3A%2F%2Fkedehang24h.blogspot.com%2F2015%2F04%2Fgia-ke-sieu-thi-ha-noi.html → -> htxp://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4f57432236fb4dee
blocked for me. uMatrix has prevented the following page from loading:
-http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4f57432236fb4dee
This -https://www.blogger.com/static/v1/jsbin/3846568130-comment_from_post_iframe.js
and
http://www.domxssscanner.com/scan?url=http%3A%2F%2Fcctinanh.blogspot.com%2F
See website risk status (7 red out of 10) here: http://toolbar.netcraft.com/site_report?url=http://cctinanh.blogspot.com
and this Cloudflare domain link: -sock-p.subiz.com content =

{"status":200,"name":"sock-p"}

then landing at -http://www.statcounter.com/counter/counter.js

polonus