well is that firewall thing part of the program? if not maybe he shelled a specific command that "replaces the file"