Most likely a false alert, Sean. One of the exes in that article is a listening socket server which is the trademark of a trojan, so most anti-viruses would think it's a malicious binary unless it's signed or otherwise authenticated. Regards, Nish Are you addicted to CP? If so, check this out: The Code Project Forum Analyzer : Find out how much of a life you don't have! My technology blog: voidnish.wordpress.com