hey satyric0n, I didnt have any such luck. The call is coming from one of the temp dll's. sh_t! any ideas?= check it out:

Call stack of main thread
Address Stack Procedure / arguments Called from Frame
0012DACC 77D43C53 Includes 7FFE0304 USER32.77D43C51 0012DB00
0012DAD0 77D4B3F2 USER32.WaitMessage USER32.77D4B3ED 0012DB00
0012DB04 77D4D9A0 USER32.77D4B265 USER32.77D4D99B 0012DB00
0012DB2C 77D6AE8E USER32.77D4D8EC USER32.77D6AE89 0012DB28
0012DDE4 77D6A911 ? USER32.SoftModalMessageBox USER32.77D6A90C 0012DD6C
0012DF2C 77D6AFD5 ? USER32.77D6A7D7 USER32.77D6AFD0 0012DEB4
0012DF84 77D6B0BD USER32.MessageBoxTimeoutW USER32.77D6B0B8 0012DF80
0012DFB8 77D6B04A ? USER32.MessageBoxTimeoutA USER32.77D6B045 0012DFB4
0012DFD8 77D6B02E ? USER32.MessageBoxExA USER32.77D6B029 0012DFD4
0012DFDC 0003041A hOwner = 0003041A ('Software Registration',class='#32770',parent=0003
0012DFE0 003A6450 Text = "Registration Failed - your registration key has not been acce
0012DFE4 003A3ED0 Title = ""
0012DFE8 00000030 Style = MB_OK|MB_ICONEXCLAMATION|MB_APPLMODAL
0012DFEC 00000000 LanguageID = 0 (LANG_NEUTRAL)
0012DFF0 00428B04 ? USER32.MessageBoxA 6D79C0BD.00428AFE /6d79c0bd (6d79c0bd.dll) is on of the two elusive dll��s that are written in C:\Documents and Settings\jdog\Local Settings\Temp and then deleted!!
0012DFF4 0003041A hOwner = 0003041A ('Software Registration',class='#32770',parent=0003
0012DFF8 003A6450 Text = "Registration Failed - your registration key has not been acce
0012DFFC 003A3ED0 Title = ""
0012E000 00000030 Style = MB_OK|MB_ICONEXCLAMATION|MB_APPLMODAL

thanks,
Jeff