   Executing programs before the shell comes up?
  Some programs, especially common with defragmenters, start themselves up, even before windows is full loaded.One example is this program, which defragments the page file:http://www.sysinternals.com/Utilities/PageDefrag.htmlIf you start it, chose the option "defragment at next boot", and then reboot, you will very much see what I mean.So, my question is: How to do something like that too?   
  The shell for a console will always come up, however, for a windows program, if you don't make a window, you get no window.  So, put your program in the registry so that windows loads it up first and executes it.   ;  Here are a few links that might help.STARTUP PROGRAM LOADINGWindows Program Automatic Startup LocationsLaunching an Application on Windows StartupLooking over pagedfrg.exe in a pe file hacking tool reveals that a device driver (pagedfrg.sys) and a system service exe (pgdfgsvc.exe) are stored in the resource section of that utility. Either of those files could accomplish the task. Using Regmon to monitor the registry activity of pagedfrg.exe after selecting the "defrag at next boot" option reveals the following activities:143304.01150513pagedfrg.exe:1472QueryValueHKLM\System\CurrentControlSet\Control\Session Manager\BootExecuteSUCCESS"autocheck autochk *"144304.01153564pagedfrg.exe:1472QueryValueHKLM\System\CurrentControlSet\Control\Session Manager\BootExecuteSUCCESS"autocheck autochk *"155320.61981201pagedfrg.exe:1472SetValueHKLM\System\CurrentControlSet\Control\Session Manager\BootExecuteSUCCESS"autocheck autochk *"So it appears that HKLM\System\CurrentControlSet\Control\Session Manager\BootExecute is the registry key to focus on - plug that key into google web and google groups and start reading. YMMV.   ;  Thanks.Googling gave me these links:http://www.sysinternals.com/Information/NativeApplications.htmlhttp://www.sysinternals.com/Information/NativeApi.htmlIt seems only "native" apps can be executed with bootexecute (and no, win32 isn't native).Interesting.   ;Quote:Original post by LessBreadHere are a few links that might help.STARTUP PROGRAM LOADINGWindows Program Automatic Startup LocationsLaunching an Application on Windows StartupLooking over pagedfrg.exe in a pe file hacking tool reveals that a device driver (pagedfrg.sys) and a system service exe (pgdfgsvc.exe) are stored in the resource section of that utility. Either of those files could accomplish the task. Using Regmon to monitor the registry activity of pagedfrg.exe after selecting the "defrag at next boot" option reveals the following activities:143304.01150513pagedfrg.exe:1472QueryValueHKLM\System\CurrentControlSet\Control\Session Manager\BootExecuteSUCCESS"autocheck autochk *"144304.01153564pagedfrg.exe:1472QueryValueHKLM\System\CurrentControlSet\Control\Session Manager\BootExecuteSUCCESS"autocheck autochk *"155320.61981201pagedfrg.exe:1472SetValueHKLM\System\CurrentControlSet\Control\Session Manager\BootExecuteSUCCESS"autocheck autochk *"So it appears that HKLM\System\CurrentControlSet\Control\Session Manager\BootExecute is the registry key to focus on - plug that key into google web and google groups and start reading. YMMV.I'm on Windows XP (no SP packages, crash my system for some reason), and have not installed that software, but I'm not finding a BootExecute folder anywhere in the Control folder.  Either it's installed with the program and launched by something else, or an update from Windows I haven't gotten.  Just my little heads up.   ;  It's not a folder, it's a key in HKLM\System\CurrentControlSet\Control\Session ManagerThe entry type is REG_MULTI_SZ. After selecting the "run at next boot" option from pagedfrg the value of this entry isautocheck autochk *pgdfgsvc C 1 -owhich tells me that the application invoked at boot is the service app stored in the resource section of pagedfrg.exe. This machine is running XP sp2. @VeryBoringNickName - check out google groups too.   ;Quote:Original post by LessBreadIt's not a folder, it's a key in HKLM\System\CurrentControlSet\Control\Session ManagerThe entry type is REG_MULTI_SZ. After selecting the "run at next boot" option from pagedfrg the value of this entry isautocheck autochk *pgdfgsvc C 1 -owhich tells me that the application invoked at boot is the service app stored in the resource section of pagedfrg.exe. This machine is running XP sp2. @VeryBoringNickName - check out google groups too.I feel stupid, forgot that if it's a file there's no slash at the end...  It's just that you said "in," so I expected a folder.  Thanks for the clarification.   