> I'm not clued in on Procmon. How would I use it to track this down? Me, I'd - fire it up. - Turn of everything except registry monitoring - Add a process filter for misexec.exe - watch the install and in particular what it thinks it is doing around your key. But I'd start with Nir's suggestion... R