ok, thanks for the infos
I think I saw some snippet like this in some y0da's source code
and it was to detect 9x\NT thats why I assumed it could be the same...