URLs and sub domains distributing the malware or acting as a redirector:
Domain hmarks91suspici.rr.nu is at: 194.28.115.150 (h150-115.net.lan-rybnitsa.com)