I am interested to run a program in stealth mode; for once at least. This program basically checks for Machine Hardware Configuration of the target machine in order to restrict unauthorized use of installation media. I searched web for such target areas apart from those like cmdlines.txt / RunOnceEx.CMD /or SVCPACK.INF which we regularly use and abuse. One interesting find is that what once upon a time used with much success by SubSeven. And that's HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{GUID} in Registry. If "StubPath=C:\PathToFile\Filename.exe" is inserted there, then Filename.exe is started BEFORE the shell and any other Program normally started over the Run Keys. Each time a NEW user logs in, the HKLM\Software\Microsoft\Active Setup\Installed Components\{GUID} will be compared with the same CurrentUser Entry and the command defined in the StubPath (can be anything) will be executed.

Now I describe my dilemma and experience with it:

1. I've included the necessary

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{GUID}]

"StubPath=C:\PathToFile\Filename.exe"

informations inside HIVESFT.INF in required format and incorporated Filename.exe in both Txtsetup.SIF and DOSNET.INF without any problem. However, as I use RunOnceEx.CMD, to my dismay, Filename.exe is not at all executed before RunOnceEx entries get completed. Further, a .BAT or .CMD is sucessfully executed from stubpath key when I use it without any RunOnceEx usage. But, a .vbs is not executed at all.

My question is whether such execution is really feasible during the course of Installation? Again, if Active Setup is really executed even before explorer loads, then what environment is available at that time for proper execution of an instruction set? Does RunOnceEx takes precedence over everything after GUI Mode Setup reboots the machine?

I don't know on which dependencies rest the running of any program at such a critical time of installation. What's your opinion about it?

bump!