by the way the processes looked ok but to be sure we should map them to the directories their in (fport). for instance all instances of svchost should be running from the system directory.