Seems like it relies a lot on the "process hollowing" technique, so most HIPS should be able to interfere with this.