...is used at startup to replace in-use dll's and misc. files?

When I install an application, and it says setup will need to restart to overwrite system files that are in use, to what key does it write this information?

Possibly answered when I see the data in the key, but what folder do the newer files get placed prior to rebooting?

Thanks!

i don't think this would be just 1 file, or 1 folder, but multiple files pending on what program you install.

Yep, but assuming one file from one application, is there a predetermined root folder, like \winnt\setup, or just dump it in \temp, and the registry key's data holds the path?

But this is all contingent on learning that key.

mmm

i woudl think some where in the /temp folder and it also leaves a script or something so that when windows is booting up, it reads it and tells it to overrite files before they are put into use.

but this is just an assumtion.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

I imagine ..... if it is in the registry

I never see any new values in there before I reboot after installing.

It's become a mere curiosity now. I wanted to replace explorer.exe with mine, but I remembered I can use the recovery console to get NTFS DOS, and just copy it.

Those registry entires are possible places to run update programs upon reboot if an application requires them.

If you just wanted to replace explorer.exe with a hacked version...it would have been easier to say so in the beginning

Just my $0.02

Go to microsoft.com

Download "Inuse.exe"

It will let you replace files that are in use.
Nuke explorer from your cache first or it will revert to normasl version

use sfc /? for other options that may help you.

Ooooh, I think you nailed this one stone cold