What is unknown_html_RFI_eval doing on this malicious site?

See: http://www.virustotal.com/url-scan/report.html?id=6dceeba7c58ead423c8b9dc3aa41bbfc-1323967952
and
http://www.virustotal.com/file-scan/report.html?id=51b88d3d22bf1da4acac72f545adbb4695ef885d73fa664061a0e562d0da73af-1323971557
http://vscan.urlvoid.com/analysis/152a266b9fe136cf186018e8efe5d846/anN0YWctMS00YjEtNjM4/
Bad web rep site: http://www.mywot.com/en/scorecard/sun-tur.ru
http://www.webutation.net/go/review/sun-tur.ru
I get an error here:
-http://sun-tur.ru/shop/images/depois.php - archive JS-HTML

-http://sun-tur.ru/shop/images/depois.php/JSTAG_1[4b1][638] - Ok
-http://sun-tur.ru/shop/images/depois.php/ - read error!
See: http://urlquery.net/queued.php?id=12046 verdict malicious

Phishing activity: http://safeweb.norton.com/report/show?url=http%3A%2F%2Fsun-tur.ru%2Fshop
Three malicious pages found there according to Unmasked Parasites report:
http://www.google.com/safebrowsing/diagnostic?site=www.sun-tur.ru
where infections were from here: http://safeweb.norton.com/report/show?url=drcutrapalis.orge.pl%3F

pol