Detected by Malwarebytes as Trojan.Agent.DE. Note that the target is a Windows Alternate Data Stream (ADS)

Detected by Malwarebytes as Adware.SanctionedMedia. The file is located in %System%

Detected by Malwarebytes as Trojan.Agent.QQ. The file is located in %Root%\$360Section\360SD

Detected by Symantec as Trojan.Ransomlock.D and by Malwarebytes as Trojan.SMSer. Note - this infection hooks the keyboard to prevent anything except numbers from being typed and displays a Russian message requesting a valid license key

Detected by Trend Micro as TROJ_BANLOAD.DAT

Detected by Malwarebytes as Trojan.Qausar. The file is located in %AppData%\Bitcoins

Detected by Malwarebytes as Trojan.BitCoinMiner. The file is located in %AppData%\Splwow

Detected by Malwarebytes as Trojan.Ransom.WSF. The file is located in %LocalAppData%

Detected by Malwarebytes as Rogue.TechSupportScam. The file is located in %AllUsersStartup%

Detected by Malwarebytes as Backdoor.SpyNet. Note - this is not the legitimate Google Chrome browser which is normally located in %ProgramFiles%\Google\Chrome\Application. This one is located in %System%\google

Detected by Malwarebytes as Backdoor.SpyNet. Note - this is not the legitimate Google Chrome browser which is normally located in %ProgramFiles%\Google\Chrome\Application. This one is located in %System%\google

Detected by Malwarebytes as Trojan.PasswordStealer.MSIL. The file is located in %AppData%\SubDir

Detected by Malwarebytes as Trojan.PasswordStealer.MSIL. The file is located in %AppData%\SubDir

Installed and used by rogue security products such as Cleaner2009, AntiMalwareSuite, SecureExpertCleaner and System Guard Center

Detected by McAfee as RDN/Generic.bfr and by Malwarebytes as Backdoor.Agent.DCE

QuickPage - Switch dialer and hijacker variant, see here. Also detected by Sophos as Dial/Switch-A

Detected by McAfee as Generic BackDoor and by Malwarebytes as Worm.AutoRun. Note - this is not the legitimate ctfmon.exe process associated with alternate language and method inputs which is always located in %System%. This one is located in %ProgramFiles%\MSFCache

Detected by Malwarebytes as Adware.SanctionedMedia. The file is located in %System%

Detected by McAfee as RDN/Generic PWS.y and by Malwarebytes as Trojan.Agent.QPGen