The first thing to do is immediately check out what
collegefun4u is all about.
Requesting the site in a safe way and unpacking the JS code behind it, we get:
[nothing detected] www.collegefun4u.com/
status: (referer=http:/twitter.com/trends/) saved 1205 bytes 3667a08e039642842c11744f464163baa186e4da
error: undefined variable s
file: 3667a08e039642842c11744f464163baa186e4da: 1205 bytes
file: f9e4048e7e87436e12343dbcd9d467a31f0c972e: 93 bytes
3667/a08e039642842c11744f464163baa186e4da from www.collegefun4u.com/ (1205 bytes, 17 hidden)
<title>Top 3 Webhosting</title>
<meta content="text/html; charset=iso-8859-1" http-equiv='Content-Type'>
<table border='0' cellspacing='0' cellpadding='0' width='960' height="100%">
<a target="_self" href="http://rover.ebay.com/rover/1/711-53200-19255-0/1?icep_ff3=1&pub=5574678674&toolid=10001&campid=5335950793&customid=&ipn=psmain&icep_vectorid=229466&kwid=902099&mtid=824&kw=lg">Shopping In Ebay For The Cheapest</a>
f9e4/048e7e87436e12343dbcd9d467a31f0c972e from www.collegefun4u.com/ (93 bytes)
//jsunpack.called CreateElement script //jsunpack.url http://www.google-analytics.com/ga.js
Note that I beautified the HTML for easier reading.
As you can see, it at least does not try to harm your users in any way but just inserts some Webhosting (learned from the title) spam, three links in a table that span across your whole screen. It should also be noted that they're analysis your traffic through Google Analytics.
Looking further on the internet, I've found a similar cause that appears to have the same problem as you. A request to his page later loads in the
collegefun4u site. URL Query is quite smart and tells us it detected BlackHole exploit kit HTTP GET request.
Exactly, the BlackHole exploit kit is gaining fame these days to adjust files on servers. They simply use zero day exploits in various types of server software to be able to adjust files to be able to spam or infect many clients.
The bottom line of the story here is three fold:
Track the versions of your server and its software and make sure everything is update, this goes from Apache / IIS to Plesk to your framework to PHPMyAdmin and beyond.
Make sure you configured anything facing the internet to not be able to write to your disk, this mostly means configuring Plesk / PHP / File Permissions right.
If it continues to happen, make sure that you log file accesses so that you know which process is doing this. On Windows you have Process Monitor for this, set it to filter on
.js files so you don't fill your page file with all accesses. This might learn you more...