The reason it is they detect it as a virus is because healing.dll calls server.dll and that is the string the AV think suspicious, plus it reads protected memory, the combo is the cause. IF Server.dll was called something else and healing.dll referenced it, I doubt the AVs would find it.... but I am unsure of how many of your dll/exe reference it... so I pass the ball back to your side... heh