Detected by Malwarebytes as Trojan.Injector.AI

Detected by Malwarebytes as Trojan.Agent

Detected by Malwarebytes as Trojan.Downloader.RND - see an example here

Detected by Dr.Web as Trojan.Inject1.36150 and by Malwarebytes as Trojan.Agent.Gen

Detected by Sophos as Troj/LowZone-AA

Added by a variant of W32.IRCBot. The file is located in %System%

Detected by Dr.Web as Trojan.DownLoader13.33703 and by Malwarebytes as Trojan.Banker.E

Detected by Sophos as Troj/Agent-LNU and by Malwarebytes as Trojan.Downloader

Detected by Malwarebytes as Trojan.Agent.RND - see an example here

Detected by Dr.Web as Trojan.BtcMine.28

Detected by Sophos as Troj/Agent-HVB

Detected by Sophos as Troj/Spywad-F

Detected by Malwarebytes as Trojan.Agent.RND

Detected by Panda as Banbra.GQU and by Malwarebytes as Trojan.Banker. The most common filename seen is "spoolsvr32.exe" but examples have been seen where the filename is "dchcp.exe" or "spoolfsvs.exe"

Detected by Sophos as Troj/MLogin-A

Detected by Sophos as Troj/DBdoor-B

Detected by Malwarebytes as Trojan.Downloader.RND

Added by a variant of the RANDON.AN WORM! Both files are located in %System%\detr

Detected by Symantec as Backdoor.IRC.Aladinz.K. Both files are located in %System%\PLUGINS