13 Jan
2003
13 Jan
'03
7:39 a.m.
We only need to check if the first filename given is a readable EXE/DLL. Then do the appropriate. And you can see that the only executable that seems to be called is rundll32.exe.
No, there are also C:\\WINDOWS\\RegTLib.exe and grpconv.exe...
You misunderstood me. I described this test only for RunOnceEx. RegTLib and grpconv both are in the RunOnce entries. ===== Sylvain Petreolle spetreolle(a)users.sourceforge.net Fight against Spam ! http://www.euro.cauce.org/en/index.html ICQ #170597259 "Don't think you are. Know you are." Morpheus, in "Matrix". ___________________________________________________________ Do You Yahoo!? -- Une adresse @yahoo.fr gratuite et en français ! Yahoo! Mail : http://fr.mail.yahoo.com