I can see some Mitigation Lockdown postings (the post above and in the HMP.Alert thread) where FAR.exe is involved ("Created By C:\Program Files\Far Manager\Far.exe") Is FAR.exe one of your protected programs?