unknown_html_RFI_php being detected here? JS/iFrame=abn is....

See: http://zulu.zscaler.com/submission/show/2877c865b1126033af40f48850193614-1358514628 &
https://www.virustotal.com/url/88de2787f31e4a416d222206fdfb9268d526acba694bb2d4d9af5b855f90481b/analysis/#additional-info
See the threatdumps here: http://quttera.com/detailed_report/oyagiwabed.blog83.fc2.com
JS/iFrame.abh detected there, which active malware is being detected by Avast as JS:Agent-AML [Trj] since20130117

polonus

Another unknown_html_RFI_php detection: http://zulu.zscaler.com/submission/show/d19a88f861c3b55b26d803301fa3ef73-1358783866 (nothing there) and
http://urlquery.net/report.php?id=790113 does not flag…
For suspicious returned content see image attached,

pol

P.S. Sophis detects http://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Mal~Dwnldr-Y/detailed-analysis.aspx
and see: http://minotauranalysis.com/search.aspx?q=11ea6263415c2c61b281f976c75b175f (abast detects this as Win32:Downloader-SGD [Trj])

D