>>WScript.Shell - WSHOM.OCX
>>Scripting.FileSystemObject - SCRRUN.DLL
>>VBScript.RegExp - VBSCRIPT.DLL
>>WScript.Network - WSHOM.OCX
>>Scripting.Dictionary - SCRRUN.DLL
>>
>>It appears from this that neither of the exes are required.
>
>Thanks, George - we can see that my LAN security measure came up woefully short. In fact, we knew something was wrong after Life Stages hit successfully, but not what. This explains it.
>
>Not only that, but I don't think they can disable vbscript.dll without causing major problems here. So, the new approach of filtering mail attachments is at least a big improvment over trying to pinpoint WSH files to disable.

At least we know now that they can delete the exes and not have to worry. Once it's installed, there needs to be some alot of work involved in uninstalling. There are a number of registry keys to be deleted as well as the files. The files don't appear (at a glance at the wshom.ocx property sheet) to be self-registering (or unregistering).

Lastly, I've come to the conclusion that the best (read "most reliable") way to retrieve the CLSID, then retrieve the file name, then make sure it's present. A lot of work.:-)