URL scanned - two avast scan results, avast Webshield accurate!

The malware in question is PHP/Small.C and PHP/Loader.9852, both scanned here"
hxtp://vscan.urlvoid.com/analysis/86f409382dec5b861f8cd13b87cae2a5/amMtanBn/
the link scan flags PHP:Shell-AS [Trj]
and the avast Web Shield scanner on hxtp://gala-tiefbau-podlesch.de/cache/.etc/9991.jpg?? flags: {HP.PBot-U[Trj]
and on htxp://gala-tiefbau-podlesch.de/cache/.etc/jc.jpg?? the avast Web Shield flags PHO;Shell-AS[Trj]

polonus

The avast Web Shield scan results are confirmed by what is being detected here:

https://www.virustotal.com/file/d46348bae65b49ca0675d17d346b19b5cf8b8610c8dbc1af1fb8655358a808d8/analysis/1329950898/

https://www.virustotal.com/file/a50145d8ff75b7cf2dabb98b93eb3b8224efdcfc4db150ed708a5750e29baa73/analysis/1329950938/

polonus