Detected by McAfee as Generic Dropper and by Malwarebytes as Trojan.Agent

Detected by Symantec as Adware.PurityScan - also see the archived version of Andrew Clover's page. The file is located in %Root%

Detected by Malwarebytes as Backdoor.Agent.E. The file is located in %Root%\File Backup

Detected by McAfee as RDN/Generic.grp!gg and by Malwarebytes as Backdoor.Messa.E

Detected by Trend Micro as TSPY_BANKER.YYQF and by Malwarebytes as Trojan.Banker.E

Detected by Dr.Web as Trojan.DownLoader10.53560 and by Malwarebytes as Trojan.Agent

Detected by Sophos as Troj/Zapchas-EJ

Detected by McAfee as RDN/Generic Downloader.x!mk and by Malwarebytes as Trojan.Agent.MNR

Detected by Sophos as Troj/Agent-LZW

Associated with mysearchnow.com/searchbar.html (no longer live). The file is located in %System%

Detected by Malwarebytes as Trojan.Downloader.EA. The file is located in %LocalAppData%

Detected by Malwarebytes as Backdoor.Agent.E. The file is located in %System%\Installer

Detected by McAfee as RDN/Generic.dx!cnn and by Malwarebytes as Backdoor.Agent.E

Detected by Malwarebytes as Trojan.Agent.E. Note - do not delete the legitimate cmd.exe process which is always located in %System%. The "wsmprovhost.exe" file is located in %AppData% - see examples here and here

Detected by McAfee as RDN/Generic.bfr!hx and by Malwarebytes as Trojan.MSIL.BVXGen

Detected by Symantec as Trojan.Webus and by Malwarebytes as Trojan.Agent. Note - this is not the legitimate csrss.exe process

Detected by Sophos as Troj/Banker-AQ and by Malwarebytes as Trojan.Agent. Note - this is not the legitimate csrss.exe process which is always located in %System%. This one is located in a "3041" sub-folder

Detected by McAfee as RDN/Generic Dropper!rl and by Malwarebytes as Trojan.Agent. Note - this is not the legitimate csrss.exe process which is always located in %System%. This one is located in %CommonDocuments%

Added by unidentified malware. The file is located in %Windir%