on Windows Server 2003 R2 SP2 32 bit.
Following the instructions on the Malware and Spyware Cleaning Guide.
The scan seems to complete, the 'Stop' button changes back to 'Scan' but the system is unresponsive and shortly after that we get the BSOD. BSOD says some thing about KWLRPROC.SYS (I think that's the right spelling, it disappeared before I could confirm. Google tells me nothing) It's a production server so I don't want to crash it again. Nothing in the event logs.
Malwarebytes is telling us that the IPs 91x212.226.67 & 94x228.209.201 are possibly malicious and are being blocked. Could they be involved? The first is in Russia - the second in Amsterdam.