Detected by Malwarebytes as Trojan.FakeAV.DFN. The file is located in %CommonAppData%

Detected by Dr.Web as Trojan.KillProc.28692 and by Malwarebytes as Trojan.FakeAV.Gen

Detected by Sophos as Troj/Bancos-BLW and by Malwarebytes as Trojan.Banker

Detected by McAfee as RDN/Generic.dx!dc3 and by Malwarebytes as Trojan.Agent.ICU

Detected by McAfee as RDN/Generic.bfr!hd and by Malwarebytes as Trojan.Agent.Gen. Note - this is not the legitimate Windows calculator file of the same name which is located in %System%. This one is located in %AppData%\regsidt

Detected by Malwarebytes as Trojan.Agent.E.Generic. Note - this is not the legitimate Google Chrome browser which is normally located in %ProgramFiles%\Google\Chrome\Application. This one is located in %AppData%

Detected by Malwarebytes as Trojan.VB. The file is located in %AppData%\Mozilla\Firefox\extensions\{5f861d5e-11c5-4f1d-b5d2-4a34d8358787}\components\mam

Detected by McAfee as Generic.dx!zxd and by Malwarebytes as Trojan.Downloader

Detected by Malwarebytes as Spyware.Agent.E. The file is located in %AppData%\client

Detected by Malwarebytes as Trojan.KeyLogger. The file is located in %CommonAppData%\intel

Detected by Malwarebytes as Trojan.Agent. Note - this is not the legitimate CiDaemon.exe XP/2K process which is always located in %System%. This one is located in %AppData%\Microsoft\MMC

Detected by Dr.Web as Trojan.AVKill.22183 and by Malwarebytes as Trojan.Agent. The file is located in %ProgramFiles%\GoogleUpdater

Detected by Malwarebytes as Trojan.Injector.E. Note - do not delete the legitimate cmd.exe process which is always located in %System%. The "updater.exe" file is located in %AppData%

Added by a variant of W32/Sdbot.worm. The file is located in %System%

Detected by McAfee as Generic.dx!uiz and by Malwarebytes as Trojan.Agent

Detected by Malwarebytes as Ransom.Agent.E. Note - this is not the legitimate Microsoft Windows 10/8/7 process with the same filename which is used to host the cmd.exe console window and is located in %System%. This one is located in %CommonAppData%\MicroSoftTMP\system32

Detected by Sophos as Troj/VB-FIS and by Malwarebytes as Backdoor.Agent

Detected by Sophos as Troj/Dldr-G. Note - this is not the legitimate Microsoft Console IME process of the same filename which is located in %System% and is used when an Asian language is used in Windows. This one is located in %Windir%

Detected by McAfee as RDN/Generic.dx and by Malwarebytes as Trojan.Banker.IDP