URLs and sub domains distributing the malware or acting as a redirector:
Domain myconstructor.ru is at: 78.110.50.152 (cl4-w.ht-systems.ru)