URLs and sub domains distributing the malware or acting as a redirector:
Domain lessexpensivehow.ru is at: 176.31.121.11 (ks395654.kimsufi.com)