> >We only need to check if the first filename given is a readable > >EXE/DLL. > >Then do the appropriate. And you can see that the only executable > that > >seems to be called is rundll32.exe. > > No, there are also C:\\WINDOWS\\RegTLib.exe and grpconv.exe... > You misunderstood me. I described this test only for RunOnceEx. RegTLib and grpconv both are in the RunOnce entries.
===== Sylvain Petreolle [EMAIL PROTECTED] Fight against Spam ! http://www.euro.cauce.org/en/index.html ICQ #170597259 "Don't think you are. Know you are." Morpheus, in "Matrix". ___________________________________________________________ Do You Yahoo!? -- Une adresse @yahoo.fr gratuite et en français ! Yahoo! Mail : http://fr.mail.yahoo.com
