This was answered in another newsgroup.
If you must post identical messages in more than one
newsgroup please crosspost, i.e. please place all of the
newsgroups in the Newsgroup field of one message,
separated by commas. That way when someone reads the
message in one newsgroup it will be marked as read in all
of them. In addition, an answer posted in one newsgroup
will generally show up in all of them.
>-----Original Message-----
>We are using XP Home SP2, with out the Welcome Screen (or
>Fast User Switching).
>
>After my son has plays some CD-ROM based games, (in
>particular, Diablo II), I have noticed that the machine
>seems palpably slower; in investigating this, I have
>noticed that there a DLL is loaded in the Explorer.EXE's
>memory space called CmdLineExt03.DLL, which I immediately
>pegged as as fishy because of its path: "\Documents And
>Settings\{my son's username}\Local
>Settings\Temp\CmdLineExt03.DLL".
>
>For some reason it was loaded into MY Explorer.EXE's
>address space even after my son logged off and I logged
in.
>
>The reason I suspected this is that I had to temporarily
>make him an administrator in order to for him to be able
to
>even run the game; otherwise, it wouldn't start for him,
>although it ran OK for me (I am admin).
>
>Later, after discovering CmdLineExt03.DLL, I changed him
>back to a restricted user and removed all registry
>references to CmdLineExt03.DLL (after which he was
>apparently still able to start the game up -- go figure).
> This caused the slowness I had experienced to dissipate.
>
>Later, I noticed that although CmdLineExt03.DLL was still
>loading into his explorer.exe's address space, it went
away
>when he logged and I logged in.
>
>I would like to block this dll from from being loaded,
>however temporarily, and even from being written to
>anyone's temp directory if possible, but MS Anti-Spyware
>will not allow an addition to the list of blocked Shell
>Extensions and/or Shell Execute Hooks and/or Shell Open
>Commands unless it has previously detected and either
>allowed or blocked it (based upon the user's selection).
Is
>there a reason for not allowing additions?
>.
>
|
Similar Threads
