If the real-time protection is installed, you will be able to see in this window the processes that run other processes (in a cascade or arboreal way).

This is very useful since many times the spywares launch simultaneously several processes; thus, if you close one, the other one detects it and runs it again; so it makes it impossible to close.

Totally valid processes like IEXPLORE.EXE or EXPLORER.EXE may have being injected with malicious dll that will ‘reopen’ processes that have been closed. You will be able to spot these operations here.

Once you have identified the list of processes that are involved in the operation, you will be able to select them simultaneously in the processes flap with control key and terminate them at a time.

If it is not advisable to close the infected process for any reason (for example, svchost), we recommend you to clean it in safe mode.