In news:e47dBMKoIHA.2208@TK2MSFTNGP04.phx.gbl,
- <-> typed:
> Thanks Ace,
>
> That did the trick. I have used Process Explorer in the past but
> didn't know it had this capability. It would be nice if threads
> didn't share executables, but c'est la vie.
>
> Cheers

I agree. That's how malicious processes can hide under the svchost.exe as
well as others that can hide and run under winlogon.exe, which is a nastier
bug but can be found using Process Explorer.

Cheers!
Ace