hi, I have 2 modified files :

logonui.exe

ntoskrnl.exe

When I copy them in my c:\windows\system32 , windows ask to me to overwrite the existing files.. well, I accept; but some seconds later, the modified files are replaced by the old one... any clue?

here's my bootlogo.cmd file :

REM bootcfg /RAW /A /Kernel=ntoskrnl.exe /ID 1

REM bootcfg /Timeout 0

windows file protection at work.

you have to disable it.

try renaming your files.

since you're using the /kernel switch in boot.ini, you can name the kernel anything, and WFP won't have a problem.

the logon screen, you can change with a registry tweak.

you can name the logonui.exe anything.

but the key is

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
UIHost="C:\Windows\Resourcs\LogonUI\logon.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
UIHost="C:\Windows\Resourcs\LogonUI\logon.exe

can you use variables like %windir% in that key? or it needs to be in hex mode? how it look like on hex?:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]UIHost="%WINDIR%\System32\oemlogo.exe"

I translated that from my INF where i can use variables. I don't know if you can in a normal regsitry key.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]"UIHost"=hex(2):25,00,57,00,49,00,4e,00,44,00,49,00,52,00,25,00,5c,00,73,00,79,\

  00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,6f,00,65,00,6d,00,6c,00,6f,00,\

  67,00,6f,00,2e,00,65,00,78,00,65,00,00,00

reaname your custom "logonui.exe" to "oemlogo.exe" and place it in your system32 folder