Peter, These are the scan engine files and can be seen as non-plug and play device drivers. They reside above the file system recognizer in 2000 and work in conjunction with the SpntSvc.exe service but are not launched by them. They hook into the kernel driver so I believe you would need a tool that can look at what the device drivers are doing, I don't have a tool or know of one to do so but someone else might. Jeff -----Original Message----- From: Peter.Frey@xxxxxxxx [mailto:Peter.Frey@xxxxxxxx] Sent: Thursday, June 27, 2002 4:08 PM To: thin@xxxxxxxxxxxxx Subject: [THIN] Re: Server slowing down for about 5-10mins Hi Jeff, I found it. It was not in the WINNT folder but under C:\Program Files\Trend\SProtect\TMFilter.sys. File Version 6.150.0.1001. I also checked with ProcessExplorer v5.23 (a great utility from www.sysinternals.com, unfortunately we did not know it last autumn when we had the problems with trendmicro) but could not find a TMFilter.sys beeing loaded neither by the EarthAgent.exe, TrendVcsAgent.exe nor SpntSvc.exe process. In what process context should it be running? Or will it be loaded only on demand? Peter > -----Original Message----- > From: Jeff Rapp [mailto:JeffR@xxxxxxxxxxxxxxxxx <mailto:JeffR@xxxxxxxxxxxxxxxxx> ] > Sent: Thursday, June 27, 2002 3:55 PM > To: 'Thin@xxxxxxxxxxxxx' > Subject: [THIN] Re: Server slowing down for about 5-10mins > > > Peter, > > If you are still running Trend Micro ServerProtect then you > have to have a > TMFilter.sys. This is one of the drivers that ServerProtect > uses. It is not > possible for ServerProtect to operate without this file. > Since this is a > file it would not show in Task Manager you would need other > tools to see > what resources this driver was using.... > > Jeff >