I've observed this file installing in the user's temp directory (typically c:\documents and settings\username\temp) when Unreal Tournament is played. I found some (unverified) references on the web regarding files of this type impacting CD operations. If you try to delete the file (even when Unreal isn't running), the system complains of it being in use.
This file gets created after reboots because of four references in the registry:
[HKEY_CLASSES_ROOT\CLSID\{9869EFB4-18E9-11D3-A837-00104B9E30B5}\InprocServer32]
(file path)
[HKEY_CLASSES_ROOT\TypeLib\{9869EFA6-18E9-11D3-A837-00104B9E30B5}\1.0\0\win32]
(file path)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9869EFB4-18E9-11D3-A837-00104B9E30B5}\InprocServer32]
(file path)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{9869EFA6-18E9-11D3-A837-00104B9E30B5}\1.0\0\win32]
(file path)
I created a .reg file to get rid of it (you can cut and paste, saving as a .reg file):
Windows Registry Editor Version 5.00
[-HKEY_CLASSES_ROOT\CLSID\{9869EFB4-18E9-11D3-A837-00104B9E30B5}\InprocServer32]
[-HKEY_CLASSES_ROOT\TypeLib\{9869EFA6-18E9-11D3-A837-00104B9E30B5}\1.0\0\win32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9869EFB4-18E9-11D3-A837-00104B9E30B5}\InprocServer32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{9869EFA6-18E9-11D3-A837-00104B9E30B5}\1.0\0\win32]
(the '-' sign inside the bracket removes the designated key).
To remove CmdLineExt02.DLL:
- remove the registry keys (either manually, or by creating a .reg file).
- reboot the system.
- navigate to the users temp directory and delete CmdLineExt02.dll.
One way to keep it removed:
- after the steps above, create a new text file named CmdLineExt02.dll (this file will be zero length).
- set permissions on the new file to the administrator login only (this will prevent the file from being recreated).
Now, there's not guarantee that the folks who place this file on your system won't sort out a way to change the name to something other that which we recognize, but if you do have issues with this version, this technnique will resolve them. Further, you can use this technique to thwart other similar intrusions.