You may try as well injecting into winlogon and catching dwm.exe starting, injecting your DLL by the way. Or hijack some system CLSIDs which dwm uses, but that won't be much better than system file patching. Also, when writing AppInit_DLL, make sure it does not link directly to user32.dll or libraries using it, otherwise it may fail to initialize (that was true in 2000 times).