Dear Dave, Currently have no access to similar software necessary to replicate, but have you considered trying out the usual hooking techniques (WSAConnect, WSASend..etc) ? http://www.bindshell.net/tools/echomirage -- http://secdev.zoller.lu Thierry Zoller Fingerprint : 5D84 BFDC CD36 A951 2C45 2E57 28B3 75DD 0AC6 F1C7