Index: /trunk/src/VBox/Additions/common/VBoxService/VBoxServicePageSharing.cpp
===================================================================
--- /trunk/src/VBox/Additions/common/VBoxService/VBoxServicePageSharing.cpp	(revision 29958)
+++ /trunk/src/VBox/Additions/common/VBoxService/VBoxServicePageSharing.cpp	(revision 29959)
@@ -363,7 +363,7 @@
     
         NTSTATUS ret = ZwQuerySystemInformation(SystemModuleInformation, (PVOID)&cbBuffer, 0, &cbBuffer);
-        if (ret != STATUS_INFO_LENGTH_MISMATCH)
+        if (!cbBuffer)
         {
-            VBoxServiceVerbose(1, "ZwQuerySystemInformation returned %x (1)\n", ret);
+            VBoxServiceVerbose(1, "ZwQuerySystemInformation returned length 0\n");
             goto skipkernelmodules;
         }
@@ -383,4 +383,13 @@
         for (unsigned i = 0; i < pSystemModules->NumberOfModules; i++)
         {
+            /* User-mode modules seem to have no flags set; skip them as we detected them above. */
+            if (pSystemModules->Modules[i].flags == 0)
+                continue;
+
+            char *pszDot = strrchr(pSystemModules->Modules[i].FullPathName, '.');
+            if (    pszDot 
+                &&  (pszDot[1] == 'e' || pszDot[1] == 'E'))
+                continue;   /* ignore executables for now. */
+
             /* Found it before? */
             PAVLPVNODECORE pRec = RTAvlPVGet(&pNewTree, pSystemModules->Modules[i].ImageBase);
@@ -401,5 +410,5 @@
 
                     /* skip \Systemroot\system32 */
-                    char *lpPath = strstr(pSystemModules->Modules[i].FullPathName, "\\system32");
+                    char *lpPath = strchr(&pSystemModules->Modules[i].FullPathName[1], '\\');
                     if (!lpPath)
                     {
@@ -428,4 +437,5 @@
                     VBoxServiceVerbose(3, "\n     executable     = %s",             pModule->Info.szExePath );
                     VBoxServiceVerbose(3, "\n     base address   = 0x%08X", (DWORD) pModule->Info.modBaseAddr );
+                    VBoxServiceVerbose(3, "\n     flags          = 0x%08X",         pSystemModules->Modules[i].flags);
                     VBoxServiceVerbose(3, "\n     base size      = %d",             pModule->Info.modBaseSize );