ok thanks.
It seems to be flagging the favicon.ico telling me it's an object called HEUR.Trojan.Script.Generic.
When I did a search on the object, a Kaspersky tech guy, in relation to a webpage another user was having similar trouble with, said it wasn't a false positive and linked most of the nefarious script to back it up.
Could be a different thing entirely this (i.e. different script same message), but guess it's one for the admin to choose to do something or not.