On my Win10 notebook I had to clear out an (Chameleon Explorer) infection - which after a bit of effort I was able to get fully rid of...
Along the way however I noticed some interesting code - namely,
file:///C:\PROGRA~3\ZVMIMC~1\ACTIVA~1.EXE
The instruction obviously ran the ACTIVA~1.EXE...