URLs and sub domains distributing the malware or acting as a redirector:
Domain directs009.ru is at: 78.46.101.80 (static.80.101.46.78.clients.your-server.de)