Hey gents. Just my 2 cents... In my opinion (without access to your log files and other tools), it appears that the ahevents.org site is a launching platform for a cross site scripting attack. Here is how it works.
1. Bad guy in Russia hacked ahevents.org via some Web malware content (there are literally hundreds of ways to do this).
2. Now ahevents.org is a launching platform (for lack of better words) for attacks from the Russian site.
3. ahevents.org sits there waiting for a bunch of cartoon pilots to surf to it and check out their FSO scores
a. Cartoon pilot uses a Web browser to surf to ahevents.org
b. Once there, ahevents.org now exploits cartoon pilot's Web browser
c. Once that happens and depending upon how much security is on cartoon pilot's computer...
d. Malware is delivered from Russian site to cartoon pilot's computer
e. Russian dude now has your BoA password (assuming you bank with BoA) and all those nekkid pics of your wife
That's how it works. Best thing to do is reinstall ahevents.org from a known good back up.. Use a web scanner to scan it and go from there. Easier than flying a P38.
S1n1ster
