I would also suggest using the ???? for the dynamic entries. It just signifies one character like jcgriff mentioned and furthermore it generates curiosity (at least in me) as to what these drivers are
But, my point would be that it would be causing extra trouble? Usasma do you just have to select and then delete the entries or is it something different? Though you must add the TMP Driver along with a proper description which means to list all the facts that we know about it. You would need to like Underline the fact that the WinRing service is only visible in the Event Log and not anywhere in the loaded modules list (Except for these temporary drivers) or the MSINFO32 Report as well.
We were just plain lucky that the Event Log contained the program which is being associated with this as in almost every other Event Log which was scanned, there was only this service and no information as to what is executing this one.
@jcgriff2 - If you look at the Emsisoft Drivers (All of them in the DRT), you would notice the thing that the last 2 digits before ".sys" are 32,86 / 64 which depict the Product Version which is installed. Like either it is 64bit or 32bit which is installed on the system. This is not valid in the case of Alcohol/Daemon Tools. But, your point is 120% valid as well. This might confuse us as well in some cases. But, a note in the description as in which conditions this is valid can be done in bold or some other colors to highlight such kind of tmp????.tmp driver.
@usasma - There is a driver over here -
Driver Reference Table - mchInjDrv.sys which is considered likely to be a part of Emsisoft A Squared. But, I think it is part of other software as well. You can check the driver's name in the strings which are extracted from a different software over here -
Malware scan of Modviewer.exe e99c3c08c5ca999656edb465a58b41d8d0bc4073 - herdProtect
&
https://forums.comodo.com/virusmalw...e/mchinjdrvsys-t9257.0.html;msg67465#msg67465
As far as I can see in the DRT, there are loads of errors which are now coming up because of the fact that links change.
