for those types of programs (including the Windows Memory Browser that comes with SpyWorks 6) that can show all loaded modules, a person would really have to know what to look for to find the mysterious dll. The end user is less likely to realize the file is new if it appears to be part of a program (Explorer for example).