See: unknown_html ARIN US abuse at nobistech dot net 142.91.142.222 to 142.91.142.222 tmdss dot com htxp://lilaiyulewang.yulecheng.tmdss.com/
see: http://urlquery.net/report.php?id=7378702
Foud there IDS for ET WEB_CLIENT Possible HTTP 500 XSS Attempt (External Source) & for FILE-IMAGE Directshow GIF logical width overflow attempt.
Server info: microsoft-iis/6.0
php/5.2.17
CMS: showweb-tianfeng (build: 3.0.070707) → https://asafaweb.com/Scan?Url=lilaiyulewang.yulecheng.tmdss.com
Malware on IP: http://support.clean-mx.de/clean-mx/viruses.php?id=16416172 should be detected as S:Agent-CBY [Trj] by avast!
Removal instructions: http://guides.yoosecurity.com/jsagent-cdn-trj-removal/
polonus