Detected by Sophos as Troj/Bancos-BBW

Detected by Dr.Web as Trojan.Siggen6.21360 and by Malwarebytes as Backdoor.Agent.E

Detected by Malwarebytes as Backdoor.Agent. The file is located in %ProgramFiles%\system32

Detected by McAfee as RDN/Generic BackDoor!nz and by Malwarebytes as Backdoor.XTRat

Detected by Trend Micro as TROJ_DROPPER.QBS and by Malwarebytes as Worm.Palevo. Note - this entry adds a HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon "Taskman" entry which loads the file "djjqs.exe" (which is located in %AppData%)

Detected by Trend Micro as WORM_RIMCUD.SM and by Malwarebytes as Worm.Rimecud. Note - this entry adds a HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon "Taskman" entry which loads the file "dllrun32.exe" (which is located in %Recycled%\{SID})

Detected by Dr.Web as Trojan.MulDrop2.27027 and by Malwarebytes as Trojan.Agent.TRL

Detected by Dr.Web as Trojan.DownLoader9.10879

Detected by McAfee as RDN/Generic BackDoor!tv and by Malwarebytes as Backdoor.Agent.DCE

Detected by Malwarebytes as Trojan.InfoStealer.E. The file is located in %AppData%\Windirt

Detected by Malwarebytes as Trojan.Agent.E. The file is located in %AppData%\Microsoft\Windows\Start Menu\Programs (10/8/7/Vista) or %UserProfile%\Start Menu\Programs (XP)

Detected by Malwarebytes as RiskWare.BitCoinMiner.E. Note - this is not the legitimate Desktop Window Manager (dwm.exe) process from Windows 10/8//7/Vista which loads as a service and is located in %System%. This one is located in %CommonAppData%\WindowsTask

Detected by Sophos as Troj/Agent-LWB

Detected by Sophos as Troj/Zbot-KM

Added by a variant of W32/Sdbot.worm. The file is located in %System%

Detected by McAfee as RDN/Generic.bfr!hi and by Malwarebytes as Trojan.Agent.PT

Detected by Malwarebytes as Worm.Palevo. Note - this entry adds a HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon "Taskman" entry which loads the file "eqegwk.exe" (which is located in %AppData%)

Detected by Sophos as W32/Sdbot-ABR

Detected by Malwarebytes as Trojan.Agent.TSK. Note - this is not the legitimate MS Excel process of the same name, which is always located in a sub-folder of %ProgramFiles%\Microsoft Office. This one is located in %UserTemp%\Dropbox