Figure 17 shows the list of processes that the routine searches on infection :  EndpointBasecamp.exe Trend Micro Endpoint Basecamp ResponseService.exe PccNTMon.exe SupportConnector.exe AOTAgent.exe CETASvc.exe CETASvc iVPAgent.exe tmwscsvc.exe TMResponse AOTAgentSvc TMBMServer iVPAgent Trend Micro Web Service Communicator Tmccsf Tmlisten Ntrtscan TmWSCSvc       Figure 17.