Simple. I've just read technical CAN buletin mentioned in article. It says integer overflow occurs in LoadImage() function when dwResSize value (4-bit) exceeds maximal word (2-bit) value. If dwResSize will be ~FFFFFFFF (-1) then malicious code can be executed. So, hacked version of user32.dll has patched import table which LoadImage() points to loader written in "unused" space. It loads Ti......DLL and gives it control. Check function in Ti......DLL opens icon file and checks if dwResSize>maximal word value. If it is, function fails (so virus won't be executed). If it does not, it transfers control to User32.dll original LoadImage() pointer hardcoded. [if i had Windows sources i believe it's just 1 line of code to add But, because Win9x developer team is killed, ( ) stupid NT developers trying to write a 16-bit memory hook which do the same, but: - It will consume 16-bit handles, bad - It won't protect machine until loaded - When unloaded, will crush everything] So... if ^^ that was you wanted ? As I as said before, this update isn't critical. AND MY UPDATE SHOULD BE TESTED WELL IF WILL BE INCLUDED SOMEWHERE.