phantom processes causing false alerts