looks like its the
http://removethis----xbfsrepztq.biz/dl/adv489.php in the frame that contains it.
looks like its down now or at least unstable.
2006/12/19 23:09:15.380 File infection: C:\Users\Flemming Riis\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VCQFKKIM\new489[1].htm is JS/MS06-014!exploit trojan.
2006/12/19 23:09:49.137 File infection: C:\Users\Flemming Riis\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VCQFKKIM\new489[1].htm is JS/MS06-014!exploit trojan. Deleted
2006/12/19 23:10:22.481 File infection: C:\Users\Flemming Riis\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TB9I2U5U\new489[1].htm is JS/MS06-014!exploit trojan. Deleted
2006/12/19 23:10:22.552 File infection: C:\Users\Flemming Riis\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TB9I2U5U\new489[1].htm is JS/MS06-014!exploit trojan.
2006/12/19 23:10:22.604 File infection: C:\Users\Flemming Riis\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TB9I2U5U\new489[1].htm is JS/MS06-014!exploit trojan.
2006/12/19 23:10:22.897 File infection: C:\Users\Flemming Riis\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VCQFKKIM\slide489[1].htm is JS/CVE-2006-3730!exploit trojan. Deleted
2006/12/19 23:10:22.955 File infection: C:\Users\Flemming Riis\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VCQFKKIM\slide489[1].htm is JS/CVE-2006-3730!exploit trojan.
2006/12/19 23:10:23.021 File infection: C:\Users\Flemming Riis\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VCQFKKIM\slide489[1].htm is JS/CVE-2006-3730!exploit trojan.
2006/12/19 23:10:23.200 File infection: C:\Users\Flemming Riis\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TB9I2U5U\xpladv489[1].wmf is Win32/Worfo trojan. Deleted
Diff AV than the ones above , if opened from firefox nothing is triggered
-----signature-----
Fake it till you make it