cls_pack.exe, extrac64_cab.exe and winhlp64.exe are components of trojan FakeAlert. Once the trojan is installed and started, it will configure itself to run automatically when Windows loads. Then it will show a Security Center Alert that stats that “Windows Firewall has blocked some features of this program” (Trojan-Downloader.JS.Multi.ca, Net-Worm.Win32.Mytob.t, Net-Worm.Win32.DipNet.d, Rootkit.Win32.Agent.pp) as a method to make