hs.2-8.zlkon.lv (94.247.2.8)

[RS-232]

    hxxp://www.extremetube09.com/cd
    hxxp://www.extremetube09.com/cd/
    hxxp://www.extremetube09.com/cd/1
    hxxp://www.extremetube09.com/cd/1/
    hxxp://www.extremetube09.com/cd/1/1
    hxxp://www.extremetube09.com/cd/1/1/
    hxxp://www.extremetube09.com/cd/1/1/wmcodec_update.exe

    hxxp://extrafastdownload.com/cd///setup.exe
    hxxp://extrafastdownload.com/cd///
    hxxp://extrafastdownload.com/cd//
    hxxp://extrafastdownload.com/cd/

    hxxp://myrealtube.net//cd///wmcodec_update.exe
    hxxp://myrealtube.net//cd///
    hxxp://myrealtube.net//cd//
    hxxp://myrealtube.net//cd/

All of the above are direct links to executables...depending on what url path is used,exe with a different hash will be returned.
Same type of trojan per domain name though.