Well, aswMon2.sys is the core of the Standard Shield – this is where it’s implemented, actually.
Send me the m-dumps, I’ll try to have a look at them…
The Verifier does like aswMon2.sys on our machines, to be frank… :-\