In addition, why is this malware downloding payloads etc, could it not have been pre-installed?!