Detected by Malwarebytes as Ransom.PadCrypt.Generic - where # represents a digit. The file is located in %AppData%\PadCrypt

Detected by Malwarebytes as Ransom.PadCrypt.Generic - where # represents a digit. The file is located in %AppData%\PadCrypt

Detected by Malwarebytes as Trojan.Agent - where * represents anything and # represents a digit

Detected by Malwarebytes as Trojan.Agent.ADBGen. The file is located in %Temp%

Detected by Malwarebytes as Trojan.Agent. The file is located in %Temp%

Detected by Dr.Web as Trojan.FakeAV.14091 and by Malwarebytes as Trojan.Banker

Detected by Symantec as Backdoor.Balkart

Detected by Malwarebytes as Trojan.FakeMS. The file is located in %AppData%

Detected by Dr.Web as Trojan.DownLoader11.24619 and by Malwarebytes as Trojan.Downloader.E. The file is located in %System%\gfiaseasx

AsdPlug premium rate adult content dialer

AsdPlug premium rate adult content dialer

AntiVirus ransomware security software - not recommended, removal instructions here

Detected by Malwarebytes as Trojan.Dialer. The file is located in %System%

Detected by McAfee as Generic Downloader.x and by Malwarebytes as Trojan.Downloader.DGI

Detected by Dr.Web as Trojan.PWS.Siggen.7352 and by Malwarebytes as Trojan.Agent

Detected by McAfee as RDN/Generic BackDoor!tj and by Malwarebytes as Backdoor.Agent.DCE

Detected by Malwarebytes as Trojan.FakeAdwareCleaner.A. Note - this is a fake, paid for version of the legitimate free AdwCleaner by Xplode. The legitimate program doesn't install (as it runs from the current directory) and doesn't load via the HKCU\Run key like this one. The file is located in %LocalAppData%, removal instructions here

Detected by Dr.Web as Trojan.DownLoader10.39733 and by Malwarebytes as Trojan.Downloader.E

Detected by McAfee as RDN/Generic Dropper!rm and by Malwarebytes as Backdoor.Messa.E