Do you know exactly _when_ it must be called ? Before or after RunOnce ?
Unfortunately that's not true: even in RunOnceEx, I can find these entries:
<snip>
In my opinion, the test should be done on the presence of the "|" character; if the character is present, the file name should be considered to be a DLL (regardless of the extension: e.g.
Shouldn't we check the type of the binary ?
[Software\Microsoft\Windows\CurrentVersion\RunOnceEx\812] 1038264695 "000"="C:\WINDOWS\SYSTEM\l3codecx.ax|DllRegisterServer" "001"="C:\WINDOWS\SYSTEM\mpg4ds32.ax|DllRegisterServer" "002"="C:\WINDOWS\SYSTEM\msadds32.ax|DllRegisterServer" "003"="C:\WINDOWS\SYSTEM\acelpdec.ax|DllRegisterServer" "004"="C:\WINDOWS\SYSTEM\voxmsdec.ax|DllRegisterServer"
), otherwise is a normal command line.
Alberto
===== Sylvain Petreolle spetreolle@users.sourceforge.net Fight against Spam ! http://www.euro.cauce.org/en/index.html ICQ #170597259
"Don't think you are. Know you are." Morpheus, in "Matrix".
___________________________________________________________ Do You Yahoo!? -- Une adresse @yahoo.fr gratuite et en français ! Yahoo! Mail : http://fr.mail.yahoo.com