Detected by Dr.Web as Trojan.Siggen4.20779 and by Malwarebytes as Worm.AutoRun

Detected by Sophos as Troj/PPdoor-O

Detected by Sophos as Troj/Rimecud-CI and by Malwarebytes as Worm.Palevo. Note - this entry adds a HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon "Taskman" entry which loads the file "bncto.exe" (which is located in %UserProfile%)

Detected by Trend Micro as WORM_BRONTOK.AD and by Malwarebytes as Worm.Brontok

Detected by Sophos as W32/Brontok-L and by Malwarebytes as Worm.Brontok

Detected by Malwarebytes as Worm.AutoRun.Gen. The file is located in %Recycled%\{SID}

Detected by Malwarebytes as Trojan.Agent. The file is located in %LocalAppData%

Detected by Trend Micro as WORM_BRONTOK.AD and by Malwarebytes as Worm.Brontok

Detected by Sophos as W32/Brontok-J and by Malwarebytes as Worm.Brontok

Detected by McAfee as Downloader.a!dch and by Malwarebytes as Trojan.Agent

Detected by Sophos as W32/Brontok-M and by Malwarebytes as Worm.Brontok

Detected by Trend Micro as TROJ_RIMECUD.ASH and by Malwarebytes as Worm.Palevo. Note - this entry adds a HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon "Taskman" entry which loads the file "cbzvl.exe" (which is located in %UserProfile%)

Detected by Kaspersky as Trojan-Banker.Win32.Bancos.yr. The file is located in %System%

Detected by McAfee as BackDoor-CEP!ic. Note - this is not the legitimate Windows calculator file of the same name which is located in %System%. This one is located in %Windir%

Detected by Malwarebytes as Backdoor.SpyNet. Note - this is not the legitimate Google Chrome browser which is normally located in %ProgramFiles%\Google\Chrome\Application. This one is located in %ProgramFiles%\Systen

Detected by McAfee as RDN/Generic BackDoor!ze and by Malwarebytes as Backdoor.Agent.CHR. Note - this is not the legitimate Google Chrome browser which is normally located in %ProgramFiles%\Google\Chrome\Application. This one is located in %System%\chrome

Detected by McAfee as W32/Chucem.worm

Detected by Malwarebytes as Trojan.Agent.TSK. The file is located in %CommonAppData%\Taskmgr

Detected by Sophos as Mal/EncPk-AFU. Note - this entry adds a HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon "Taskman" entry which loads the file "ciboq.exe" (which is located in %UserProfile%)