Hi heidie, welcome to the forum :slight_smile:

Please can you modify the link, to prevent others potentially becoming infected. (change http to hXXp) Thanks.

I can’t seem to access either domains (500 and 404 for them) so can’t specifically say where the script is.

I can point you in the direction of a similar thread which had the same detection mentioned.
http://forum.avast.com/index.php?topic=90145.0

Take a look for similar scripts in the site, and check all of the pages.

Scott