Because CHDK is an open source project, most of its files are on free hosting sites.
These are commercial enterprises, and have ads and (at least some of them) links
to 'adult' sites. I suppose either of these two could be trying to collect information
from visitors through the VBS scripts that your antivirus is complaining about.
I suggest you try setting your browser to a more secure state by telling it not to
accept scripts, I personally use Firefox with Noscript and never have any problems
with these sites. Other browsers probably have their own ways of doing this.
hope that helps,
wim