Yesterday, I DIY my favourite logon screen. I put it in \system32 and it worked perfectly. Then I made it to the cab file and copy it into the i386 in WINXP ISO. I used this ISO which was revised to install the OS by VMWARE, but the problem came out. when the os logon on, it show it's oringinal screen. I checked the logonui.exe ,and to my surprise, the logonui.exe was also one which I had hacked.

By the way, I also check my registry, UIHOST value is %windir%\system32\logonui.exe

what should I do ??another file needs to hack?

I found anthoer thing, which windows can recognize the hacked file. The hacked logonui is not protected by windows file protection. General speaking, logonui should be protected by WFP, so I think windows has recognized the logonui has been hacked.

I dont know whether windows calls another programe instead of logonui ,when OS starts.
Wheter differnet user has different logonui process??