ETOPS773,
Here are a couple of things you can check for:
Known variants create the following entries under the described registry key:
”windows auto update" = MSBLAST.EXE (variant A)
”windows auto update" = PENIS32.EXE (variant B)
”Microsoft Inet xp.." = TEEKIDS.EXE (variant C)
In C:\Windows\System32, known variants use the the following file names for their copy:
MSBLAST.EXE (variant A)
PENIS32.EXE (variant B)
TEEKIDS.EXE (variant C)
Take Care,
Richard