Detected by Malwarebytes as Trojan.Agent. Note - this is not a valid entry for either the TeamViewer remote support tool or Comodo security products. The file is located in %UserTemp%

Detected by Sophos as Troj/Bdoor-IP

Detected by Sophos as Troj/Comame-E and by Malwarebytes as Trojan.Agent.CN. Note - this is not the legitimate Microsoft Console IME process of the same filename which is located in %System% and is used when an Asian language is used in Windows. This one is located in %Windir%\tasks

Detected by Malwarebytes as Backdoor.Agent.CU. The file is located in %AppData%

Detected by Trend Micro as WORM_SDBOT.AJP. The file is located in %System%

Detected by Malwarebytes as Trojan.Agent. Note - this is not the legitimate csrss.exe process which is always located in %System%. This one is located in the "Microsoft" sub-folder

Detected by Trend Micro as WORM_PALEVO.SMJJ and by Malwarebytes as Worm.Palevo. Note - this entry adds a HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon "Taskman" entry which loads the file "csrss.exe" (which is located in %UserProfile% and is not the legitimate csrss.exe process which is always located in %System%)

Detected by Sophos as Troj/LegMir-BO and by Malwarebytes as Trojan.Agent. Note - this is not the legitimate csrss.exe process which is always located in %System%. This one is located in %Windir%

Detected by Sophos as Troj/StartP-HA and by Malwarebytes as Trojan.StartPage

Detected by Malwarebytes as Trojan.Downloader. The file is located in %Temp%

Detected by McAfee as RDN/Generic.bfr and by Malwarebytes as Trojan.Agent.TSK

Detected by Malwarebytes as Trojan.Agent. Note - this is not the legitimate csrss.exe process which is always located in %System%. This one is located in the "Microsoft" sub-folder

Detected by Sophos as Troj/LdPinch-W and by Malwarebytes as Trojan.Agent. Note - this is not the legitimate csrss.exe process which is always located in %System%. This one is located in %Windir%

Detected by McAfee as RDN/Generic.bfr and by Malwarebytes as Backdoor.Agent.UX. Note - this is not the legitimate csrss.exe process which is always located in %System%. This one is located in a "TF2QQS3EE" sub-folder

Detected by Sophos as Mal/EncPk-AFU and by Malwarebytes as Worm.Palevo. Note - this entry adds a HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon "Taskman" entry which loads the file "culrj.exe" (which is located in %UserProfile%)

Detected by Symantec as W32.Ogleon.A and by Malwarebytes as Trojan.Agent

Detected by Malwarebytes as Trojan.Agent. Note - this entry adds a HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon "Taskman" entry which loads the file "ctfmon.exe" (which is located in %MyDocuments% and is not the legitimate ctfmon.exe process associated with alternate language and method inputs which is always located in %System%)

Detected by Malwarebytes as Adware.KorAd.Gen. The file is located in %Windir%

Detected by Dr.Web as Trojan.KillProc.19830 and by Malwarebytes as Adware.KorAd.Gen