Ok, another unexpected result for CFP, atleast on my system. I tried to install a rootkit driver manually via w2k_loqd.exe. CFP gave SCM access alert. I denied it but driver seems to be loaded as shown by rootrepeal. Wonder if any one can confirm it. Thanks EQS- stopped it. GesWall- stopped it too. PS: Tested on a fresh snapshot of Eaz-Fix , XP Home SP2, no other security software installed at all. Fresh install of CFP with paranoid settings. Used shadowSurfer for testing though.