in some versions), they could "topple" the check by overwriting it with a tiny modified executable. The Registry Trick: