Need help to delete file from dllcache?

[xian7479]

I wanna delete some file from both system32 folder and dllcache folder before first time user login, without using WINNT.SIF and/or $OEM$. Currently, I run a CMD file from svcpack.inf (at T-13) to delete those files, but after first time user login, I find that files in system32 folder were deleted but files in dllcache folder are still there. If I run the same CMD file after user login, files in both system32 folder and dllcache folder are deleted. Does anyone know when the dllcache folder is created and is there any method to delete files from dllcache before first time user login?

Thanks!

[Takeshi]

HKLM RunOnce and RunOnceEx

[xian7479]

@Takeshi

Thanks for your reply but as I mentioned above that I'd like those files to be deleted BEFORE first time user login, so RunOnce and RunOnceEx are not what I'm looking for, is there some methods we can execute a command at or after T-9 but not the SetupParams from WINNT.SIF?

[Bezalel]

The dllcache is created at T-37 and at T-9 there is a full WFP scan so anything that got changed will be restored.

[Takeshi]

HKLM (not HKCU) RunOnce and RunOnceEx execute almost immediately on first reboot but BEFORE a user is logged on and the desktop is loaded. See mazin's post on testing RunOnce keys (I'll update my results soon). Why don't you try it and see if it works.

Unless you actually mean to do it while still in GUI setup, before reboot. But at T-9 it's finalizing installation stage and I don't know of a way to do anything there from then on.

[xian7479]

I have tested that before T-9 there are only a few .cat files inside dllcache folder so a command executed before T-9 won't delete system files from dllcache.

@Takeshi

More precisely, I wanna delete files from dllcache before first reboot.

In fact I'm writing a small utility to integrate windows updates, as the Cumulative Security Update for IE6 does delete file, so I think it's more appropriate to delete this file before or during windows installation. If I delete the file directly from installation source, I would get a error message in setuperr.log since SETUPAPI.DLL cannot register the file specified in SYSSETUP.INF which I've deleted. SYSSETUP.INF is digital signed, in order to modify it, I have to modify SETUPAPI.DLL and SFCFILES.DLL to disable digital signature verification, but I still got some problem as sometimes wrong sections in INf file without digital signature get installed. Finally, I think it should be easier to just delete this file during windows installation, but I don't wanna use HKLM RunOnce and RunOnceEx as end user may also use those keys and there is possibility to have some conflict.

Currently I'm using HKLM RunOnce as an alternative method but I still wanna find a way to delete this file before first reboot.