No idea about the js, but this is a screendump of what happens:
http://www.vanderwaa.com/zut/kol_col...i_popup_ad.gif
and the evil URL is:
hxxp://avsystemcare.com/data/?gai=tr9vel0n&gli=intl&3&tmn=av1&mt_info=4094_1538 _197&tmn=null&45080108
does that help?
Mind you: the first time I posted this avsystemcare thingy, ten minutes ago, it renamed itself once posted, and then my entire message disappeared. Moderated?