Detected by Sophos as W32/Brontok-CR and by Malwarebytes as Trojan.Agent

Detected by Malwarebytes as Trojan.Injector. The file is located in %AppData%

Detected by Symantec as W32.Beagle.A@mm

Detected by McAfee as RDN/Generic BackDoor!po and by Malwarebytes as Backdoor.Messa.E

Detected by Symantec as W32.Myfip.AC

Detected by Malwarebytes as Trojan.Spy.Ursnif. The file is located in %UserTemp%

Detected by Symantec as Trojan.Tinba and by Malwarebytes as Trojan.Agent

Detected by Kaspersky as Trojan.Win32.Buzus.hbtx and by Malwarebytes as Backdoor.Agent

Detected by Malwarebytes as Trojan.Banker.E. The file is located in %CommonAppData%

Detected by Sophos as W32/AutoRun-BHS and by Malwarebytes as Trojan.Agent

Detected by Sophos as W32/Mytob-KL

Detected by Malwarebytes as Backdoor.Agent.HKP. The file is located in %AppData%\navigate

Startportal - Switch dialer and hijacker variant, see here. Also detected by Sophos as Troj/Delf-JE

Detected by McAfee as Generic Dropper and by Malwarebytes as Trojan.Agent.MNR

Detected by Malwarebytes as Backdoor.Agent.E. The file is located in %System%

Detected by Symantec as W32.HLLW.Cake

Detected by Symantec as W32.HLLW.Cake

Detected by McAfee as Generic Dropper and by Malwarebytes as Backdoor.Agent.E. Note - this is not the legitimate Windows calculator file of the same name which is located in %System%. This one is located in %Windir%\addins

Detected by Malwarebytes as Password.Stealer. The file is located in %Temp%