I give up, first I'm not interested in bots, so I need multiclient. and I have done every possible way, and always detects Xtrap.
1 only restore the XDva387 that appears. = Xtrap closed
2 ° restored all by name ... the list below
NtDeviceloControlfile
NtOpenProcess
NtOpenSection
NtProtectVirtualMemory
NtQuerySystemInformation
NtReadVirtualMemory
NrSuspendThread
NtTerminateProcess
NtTerminateThread
NtWriteFile
NtWriteVirtualMemory
Xtrap closed
later I'll make a video to show the error......
****************
in some trials, I found that the modules:
NtOpenProcess
NtOpenSection
NtTerminateProcess
NtTerminateThread
these modules reappear by clicking 'refresh'
I think my AV 'comodo internet security' does not let them restore