Detected by Sophos as W32/Delbot-AL

Detected by Trend Micro as TROJ_ARTIEF.B

Detected by Sophos as W32/Sdbot-OO

Detected by Malwarebytes as Trojan.Agent. The file is located in %AppData%

Detected by Malwarebytes as Backdoor.Agent.NG. The file is located in %System%

Detected by Trend Micro as WORM_SDBOT.ATF

Detected by Malwarebytes as Backdoor.Agent.E. The file is located in %AppData%\Microsoft Updates

Detected by Trend Micro as WORM_AGOBOT.EW

Detected by Dr.Web as Win32.HLLW.Autoruner1.45783 and by Malwarebytes as Worm.AutoRun.E

Detected by Trend Micro as WORM_AGOBOT.OX

Detected by Symantec as Backdoor.Hale and by Malwarebytes as Trojan.Agent. Note - this is not the legitimate csrss.exe process which is always located in %System%. This one is located in a "qossrv" sub-folder

Detected by McAfee as RDN/Generic BackDoor!b2b and by Malwarebytes as Backdoor.Agent.DCE

Detected by McAfee as PWSZbot-FADC and by Malwarebytes as Backdoor.Agent.DCGen. Note - this is not the legitimate csrss.exe process which is always located in %System%. This one is located in %AppData%\Mozzilla

Detected by Dr.Web as Win32.HLLW.Autoruner1.14005. The file is located in %AppData%\WINNIT\0x03847\SYS

Detected by Sophos as Troj/Banker-CZ and by Malwarebytes as Trojan.Agent. Note - this is not the legitimate csrss.exe process which is always located in %System%. This one is located in a "D5133" sub-folder

Detected by Malwarebytes as Trojan.Agent. Note - this is not the legitimate csrss.exe process which is always located in %System%. This one is located in %CommonAppData%\Csrss

Detected by McAfee as RDN/Generic.bfr and by Malwarebytes as Backdoor.Agent.RW. Note - this is not the legitimate csrss.exe process which is always located in %System%. This one is located in %ProgramFiles%\Root Service Windows

Detected by Malwarebytes as Trojan.Agent. Note - this is not the legitimate csrss.exe process which is always located in %System%. This one is located in %Windir%\rss

Detected by Trend Micro as WORM_AGOBOT.JJ