Hi,
This extension/addon is hacking your webmails, the html has hidden iframes loading a webpage.
You can see it for example in skins/default/templates/passwd.html on line 26, it has a hidden iframe pointing to
http://NtKrnlpa.cn/rc/
Don't download this!!!!
