Added by a variant of Backdoor:Win32/Rbot - where * represents a random character

Detected by Malwarebytes as Hijack.ShellA.Gen. Note - this entry adds an illegal HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon "Shell" entry. The value data points to "explorer.exe" (which is a legitimate file located in %Windir% and shouldn't be deleted) and "2.exe" (which is located in %AppData%\Windows)

1 Click Spy Clean uses a database that was stolen from SpybotS&D. Not recommended, see here

Detected by McAfee as RDN/Generic.bfr!hw and by Malwarebytes as Backdoor.Agent.SFGen

Detected by Dr.Web as Trojan.StartPage1.5061 and by Malwarebytes as Trojan.StartPage

Detected by Malwarebytes as Trojan.Agent. The file is located in %AppData%\38FAEB

Detected by Dr.Web as Trojan.DownLoader12.24848 and by Malwarebytes as Trojan.Downloader.SVR

Detected by Malwarebytes as Trojan.MaskedTeamViewer. The file is located in %System%

Detected by Malwarebytes as Hijack.Shell.Generic. Note - this entry adds an illegal HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon "Shell" entry. The value data points to "explorer.exe" (which is a legitimate file located in %Windir% and shouldn't be deleted) and "1systemsmss.exe" (which is located in %Windir%\System64)

Detected by McAfee as RDN/Generic.bfr and by Malwarebytes as Backdoor.Agent.E

Detected by Malwarebytes as Trojan.Downloader. The file is located in %UserTemp%

Detected by Malwarebytes as Hijack.ShellA.Gen. Note - this entry adds an illegal HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon "Shell" entry. The value data points to "explorer.exe" (which is a legitimate file located in %Windir% and shouldn't be deleted) and "7iRxOsZ5mUTl.exe" (which is located in %AppData%\win)

Detected by McAfee as RDN/Generic.dx!be and by Malwarebytes as Trojan.Agent

Detected by Sophos as Troj/Mdrop-FBG and by Malwarebytes as Trojan.Agent

Detected by Malwarebytes as Backdoor.Bot

Detected by McAfee as RDN/Ransom!eb and by Malwarebytes as Backdoor.Agent.DCE. Note - this entry adds an illegal HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon "Shell" entry. The value data points to "explorer.exe" (which is a legitimate file located in %Windir% and shouldn't be deleted) and "9VSL73v.exe" (which is located in %Temp%\UovrEIZq)

Detected by Dr.Web as Trojan.MulDrop5.8935 and by Malwarebytes as Trojan.Agent.SM

Detected by McAfee as RDN/Generic.bfr and by Malwarebytes as Backdoor.Agent.SVC

Detected by Dr.Web as Trojan.Siggen6.6500 and by Malwarebytes as Backdoor.Agent.DCE. Note - this entry adds an illegal HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon "Shell" entry. The value data points to "explorer.exe" (which is a legitimate file located in %Windir% and shouldn't be deleted) and "8URJ51t.exe" (which is located in %AppData%\G9hdquLc)