foobuzz Posted February 11, 2013 Share Posted February 11, 2013 Just found out that WT 184.108.40.206 seems to set a registry entry at [HKEY_USERS\TempHive\Software\Microsoft\Windows\CurrentVersion\RunOnce]"mctadmin"="C:\\Windows\\System32\\mctadmin.exe" (In this sample TempHive is an imported NTUSER.DAT structure) I assume it stems from an option in the Tweaks section of the AIO-Integrator, just which one?I try to write a registry setting for this registry key (accessing the TempHive structure) via RunOnceEx and before the (new?) entry mctadmin appeared that worked fine, now it doesn't any longer. I tried with this lineReg add %K%\010 /f /v 4 /d "reg delete HKU\TempHive\Software\Microsoft\Windows\CurrentVersion\Runonce /f /v mctadmin"to delete it before writing my own value, however this didn't work out. :g: Quote Link to comment Share on other sites More sharing options...
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.