> As i said... it looks for the exe in ram! Other suggestions have been made already, but I'd like to point out again that this is physically impossible in several ways. It's probably detection through some other means, like (as suggested) the network.