[Tigzy]

Hello

I need to perform some operation at reboot (like file deletion, for example)
I saw this : http://www.bleepingcomputer.com/tutoria ... locations/
and wondered what would be the best and easiest way to restart my program automatically after a reboot?

I got a driver, but don't know if it's possible to start a user-mode process from the kernel. Don't know if it's safe as well.
I thought about the winlogon key, which would be the best compromise?

What do you think about it?

[EP_X0FF]

RunOnce obviously.

[Tigzy]

Yeah that would be in the best practices for any program, but for a security software I was wondering.
RunOnce is loaded after every system file, and after services. In my operations to perform, there would have file moves, file deletion. I know that I should use the MoveAtReboot API, but I was wondering if they were a place in the startup sequence where system files are free to replace, where most drivers are free to delete, and so on.
What Combofix does to be in a strategic position for file deletion? (It reboots the box and then open it's gui right after logon and before the system finished to start)

[EP_X0FF]

What Combofix does to be in a strategic position for file deletion? (It reboots the box and then open it's gui right after logon and before the system finished to start)

Hard to trace?

[Tigzy]

Nope :D
But I thought someone knows...

[EP_X0FF]

Dont you think it can simple set itself as shell and after start real shell?

[Tigzy]

Yes it can.
But I don't know everything I just asked to be sure there wasn't something less trivial
Thanks anyway

[EP_X0FF]

But I don't know everything I just asked to be sure there wasn't something less trivial

Create Native application, set it in BootExecute and perform all op's you need. Example - PageDefrag from Sysinternals.

[Tigzy]

You mean register a service at boot in the very first group?
Yeah I knew it already. Consider as solved

[EP_X0FF]

You mean register a service at boot in the very first group?

No I meant Native Application, considering you have asked about "non trivial" boot time cleaner.
http://technet.microsoft.com/en-us/sysi ... 97447.aspx