So here I was testing some dll's and changes I made to Vundofix.exe and out of nowhere appear these exe's with names that are 8 characters long and random.

After doing some analysis I found that it was adding the Winanti and Sysprotect sites as well as others to the Internet Explorer trusted zone.

Vundofix 6 has been updated and uploaded to remove these exe's as well as the entries in the trusted zone of Internet Explorer.