URLs and sub domains distributing the malware or acting as a redirector:
Domain tartis78tscolla.rr.nu is at: 194.28.115.150 (h150-115.net.lan-rybnitsa.com)