Quote Originally Posted by SebWynne
Now while the process is running without injecting a dll the values never change. So maybe we are talking about two different things......or I'm lost :P
Well, I think you will see the values change all the time if you stepped through code. For example, the return value of a function is placed in the eax register. So it will change after every function call.
The debugger won't show changes while the program is running (e.g. when you are not stopped in the debugger)... at least I don't think it will. I'm not sure why you do see it change only when a dll is loaded (unless you are stopped in the debugger at that point).

Anyway, if what you want to detect is a dll being loaded, the EAX register is not the way. Offhand I don't know of a way, but I'm sure there is one. You might try hooking the LoadLibrary API... LoadLibary is what gets called to load a dll. I've never hooked an API before, but a google search brought up this:

http://www.codeproject.com/system/hooksys.asp