Windows NT WinLogon Notify

In the NT-series Windows operating system, malware can make itself bootable by correlating winlogon specific events, such as Lock,logoff,logon,shutdown,startscreensaver,startshell, Startup,stopscreensaver,unlock and so on, which can even allow malware to be loaded in safe mode. The location of the Winlogon notification event in the registry is:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Nt\currentversion\winlogon\notify

When WinLogon.exe generates an event notification, Windows examines the specified DLL inside the registry and invokes the exported function specified by the DLL. Example (call WinLogonDemo.dll exported Lockfun function when the screen is locked):

Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Nt\currentversion\winlogon\ Notify\test]@= "" "DLLName" = "WinLogonDemo.dll" "Asynchronous" =dword:00000001 "impersonate" =dword:00000001 "Lock" = " Lockfun "

Starting with Windows Vista, this feature has been canceled. You can listen for the appropriate event by registering a service (not supported for some events), see Using Service Control Manager (SCM) notifications

Http://www.programlife.net/windows-nt-winlogon-notify.html

Windows NT WinLogon Notify