The host at this IP address is most probably hijacked/compromised and being abused by cybercriminals to host a ZeuS botnet controller (C&C).
ZeuS (also known as zbot/WSNPoem) is a banking Trojan used to steal credentials for online banking accounts from the victims computer.

ZeuS files are located here:
hXXp://avt7.in.ezar.ru/clefter/gon.bin (ZeuS config)

$ dig +short avt7.in.ezar.ru
195.211.196.178

You can find more (technical) information about this Trojan here:
McAfee: http://vil.nai.com/vil/content/v_255218.htm
Symantec: http://www.symantec.com/security_response/writeup.jsp?docid=2010-011016-3514-99
F-Secure: http://www.f-secure.com/v-descs/trojan-spy_w32_zbot.shtml

More information about this botnet controller on ZeuS Tracker

To have record SBL168163 (195.211.196.178/32) removed from the SBL, the Abuse/Security representative of tomtel.ru (or the Internet Service Provider responsible for supplying connectivity to 195.211.196.178/32) needs to contact the SBL Team by email (use this link) to explain how the spam problem has been terminated (we need to know exactly how the issue has been dealt with and that this spam problem is fully terminated). If the spam problem that caused this listing has been terminated we will normally remove the listing from the SBL without delay.

It is essential that emails to the SBL Team about this SBL listing include this exact ticket information in the email Subject:

If you are a representative of tomtel.ru, you also need to see: Current Live tomtel.ru SBL Listings