| Threat Alias | Number of Incidents |
| Hacktool.Rootkit [Symantec] | 535 |
| FakeAlert-C.dr [McAfee] | 353 |
| TROJ_ROOTKIT.CY [Trend Micro] | 300 |
| Mal/FakeAle-C [Sophos] | 215 |
| Backdoor.Win32.UltimateDefender.a [Kaspersky Lab] | 202 |
| VirTool:WinNT/Xantvi.gen!A [Microsoft] | 202 |
| NTRootKit-AC [McAfee] | 167 |
| Backdoor.Win32.UltimateDefender [Ikarus] | 70 |
| not-a-virus:FraudTool.Win32.UltimateDefender.cm [Kaspersky Lab] | 48 |
| not-a-virus:FraudTool.Win32.UltimateDefender.cm [Ikarus] | 44 |
| not-a-virus:.FraudTool.Win32.UltimateDefender.cm [Ikarus] | 39 |
| VirTool:WinNT/Xantvi.A [Microsoft] | 37 |
| Trojan.Virantix.C [Symantec] | 27 |
| Troj/KillAV-EM [Sophos] | 26 |
| TROJ_NURECH.AF [Trend Micro] | 25 |
| not-a-virus:FraudTool.Win32.XPSecurityCenter.p [Kaspersky Lab] | 4 |
| TROJ_VIRANTIX.AQ [Trend Micro] | 4 |
| TROJ_NURECH.AC [Trend Micro] | 3 |
| Generic BackDoor!l [McAfee] | 2 |
| Win-Trojan/Ultimatedefender.20992.B [AhnLab] | 2 |
| Win-Trojan/Ultimatedefender.28160.AT [AhnLab] | 2 |
| Win-Trojan/Xema.variant [AhnLab] | 2 |
| Generic PUP.x [McAfee] | 1 |
| not-a-virus:FraudTool.Win32.XPSecurityCenter.o [Kaspersky Lab] | 1 |
| RTKT_AGENT.AKTZ [Trend Micro] | 1 |
| Troj/FakeAle-DQ [Sophos] | 1 |
| TROJ_FAKEAV.L [Trend Micro] | 1 |
| TROJ_NURECH.AE [Trend Micro] | 1 |
| Win-Trojan/Agent.36352.DP [AhnLab] | 1 |
| Win-Trojan/Ultimatedefender.27648.BP [AhnLab] | 1 |