Yeah .. it is tough to detect these side-kicks these days ... with the Framework API opening up so much secret-sauce to every would-be hacker.

Use to be that one had to have a working knowledge of low-level driver & OS APIs ... now any 2-bit scripter can play whack-a-mole with the framework until they come up with a "I WIN BY CHEATING" button.

[Linked Image from w3.the-kgb.com][Linked Image from w3.the-kgb.com][Linked Image from w3.the-kgb.com]