Check the registry:
hkey_current_user\software\microsoft\windows\currentversion\runonce
malware remove tips
February 15, 2011
My Work Diary
Check the registry:
hkey_current_user\software\microsoft\windows\currentversion\runonce