the DIAG version is a little "chubby" and spills into bank 1 from bank 0 and a byte flag is created in the space it occupies. The ISP's have a way of looking at certain areas in bank 1 (image 1) to read and report back if this byte flag is there...thus the detection of Haxorware diag. The lite keeps its footprint tight, so no over spill, thus not detectable. But, you loose some of the TELNET features in Diag by using the Lite...
Knowledge=Power