We only need to check if the first filename given is a readable EXE/DLL. Then do the appropriate. And you can see that the only executable
that
seems to be called is rundll32.exe.
No, there are also C:\WINDOWS\RegTLib.exe and grpconv.exe...
You misunderstood me. I described this test only for RunOnceEx. RegTLib and grpconv both are in the RunOnce entries.
===== Sylvain Petreolle spetreolle@users.sourceforge.net Fight against Spam ! http://www.euro.cauce.org/en/index.html ICQ #170597259
"Don't think you are. Know you are." Morpheus, in "Matrix".
___________________________________________________________ Do You Yahoo!? -- Une adresse @yahoo.fr gratuite et en français ! Yahoo! Mail : http://fr.mail.yahoo.com