I think it could be done using a stricter method. Just need to take note that on Windows XP, GetModuleNameString will always return a shortened symbol name (eg: "ndiswan" becomes "ndi")