http://bugs.winehq.org/show_bug.cgi?id=7882
--- Comment #5 from Mikolaj Zalewski mikolaj.zalewski@gmail.com 2007-09-13 16:15:14 --- Created an attachment (id=8053) --> (http://bugs.winehq.org/attachment.cgi?id=8053) patch
There are two more small differences that a paranoid program could interpret as tampering - we create a dispatch thread for each service while Windows executes all advapi32 code in the thread that called StartServiceCtrlDispatcher; and it seems the program should be started as c:\Program Files... while GetModuleFileName returns C:\Program Files... Hacks in the attached patch fixes both issues but it makes no difference to Photoshop
There is a list of commonly used anti-debugger techinques at http://www.securityfocus.com/infocus/1893 but I haven't found that the service used then (there are some checks from the Photoshop process but after them the service is started so it seems they are negative).