Do you know exactly _when_ it must be called ? Before or after RunOnce ?
Unfortunately that's not true: even in RunOnceEx, I can find these entries: <snip> In my opinion, the test should be done on the presence of the "|" character; if the character is present, the file name should be considered to be a DLL (regardless of the extension: e.g. Shouldn't we check the type of the binary ?
[Software\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx\\812] 1038264695 "000"="C:\\WINDOWS\\SYSTEM\\l3codecx.ax|DllRegisterServer" "001"="C:\\WINDOWS\\SYSTEM\\mpg4ds32.ax|DllRegisterServer" "002"="C:\\WINDOWS\\SYSTEM\\msadds32.ax|DllRegisterServer" "003"="C:\\WINDOWS\\SYSTEM\\acelpdec.ax|DllRegisterServer" "004"="C:\\WINDOWS\\SYSTEM\\voxmsdec.ax|DllRegisterServer"
), otherwise is a normal command line.
Alberto
===== Sylvain Petreolle spetreolle(a)users.sourceforge.net Fight against Spam ! http://www.euro.cauce.org/en/index.html ICQ #170597259 "Don't think you are. Know you are." Morpheus, in "Matrix". ___________________________________________________________ Do You Yahoo!? -- Une adresse @yahoo.fr gratuite et en français ! Yahoo! Mail : http://fr.mail.yahoo.com